Executive brief
OrangeFS is a distributed parallel filesystem used in high-performance computing environments. A flaw in how the kernel processes directory listings allows an attacker controlling directory metadata to trigger a kernel crash (denial of service) via integer wrapping, affecting availability of systems relying on OrangeFS storage.
Technical details
The fill_from_part() function in the OrangeFS filesystem driver computes directory entry sizes using size_t but stores the result in a 32-bit unsigned integer (__u32), causing truncation when entry lengths exceed 4GB. An attacker controlling the directory part (supplied by userspace client) can craft an entry with length near U32_MAX, causing it to wrap to a small value, bypass bounds checks, and be used as an array index for out-of-bounds memory access. This results in reading far past the directory buffer, triggering a kernel panic (oops). The fix changes padlen to u64 to prevent truncation, allowing the bounds check to properly reject malicious entries. Attack requires control over directory metadata supplied by a remote OrangeFS server or client.
Affected products
- Linux Linux kernel multiple versions (OrangeFS present in kernels 2.6.11 through 7.2)
Timeline
- 2026-08-15: disclosed
- 2026-06-19: patched: Patch committed upstream (18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc)