Medium [CVE-2026-72033] keep the readdir entry size 64-bit in fill_from_part

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32.

An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry.

The trailer is supplied by the userspace client. A flaw was found in OrangeFS, a file system within the Linux kernel.

An integer overflow occurs in the fill_from_part() function when calculating the size of a directory entry. This happens because the size is computed as a 64-bit value but stored as a 32-bit value, allowing a large entry length to wrap around.

A local attacker or malicious userspace client can exploit this by providing a specially crafted directory entry, leading to an out-of-bounds read and a kernel crash. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-125. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.