External risk intelligence

Linux Kernel OrangeFS Out-of-Bounds Read Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72033

This vulnerability affects the OrangeFS filesystem driver within the Linux kernel. Kernel filesystem drivers process data from local storage or mounted shares. They are not directly exposed to the public internet, and exploitation typically requires local access or the mounting of a maliciously crafted filesystem, making public internet-facing reachability very unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's OrangeFS component could allow an attacker to read data beyond the intended directory bounds, potentially leading to system instability. The issue stems from how the kernel handles directory entry sizes.

Directory entries may exceed expected sizes.
Confirms a potential for system-wide data exposure.
Verify relevance and exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted directory entry to a Linux kernel running the OrangeFS filesystem. This crafted entry would manipulate the size calculation, causing an out-of-bounds read when the kernel attempts to process it, potentially leading to a kernel crash.

Unauthenticated network access required.
Malicious directory entry triggers vulnerability.
Kernel crash from out-of-bounds read.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's OrangeFS filesystem driver could allow an attacker to trigger an out-of-bounds read when processing directory entries. This occurs when a directory entry's calculated size, when truncated to a 32-bit integer, bypasses bounds checks and is used to index beyond the intended memory region, potentially leading to a kernel crash.

Kernel memory could be read.
Malformed directory entries could trigger reads.
System instability or crash may result.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's OrangeFS component requires careful ownership determination, likely falling to the platform or infrastructure teams managing Linux systems that utilize OrangeFS. The initial practical move is to identify all systems running OrangeFS, confirm their exposure and criticality, and then coordinate with the accountable owner to plan remediation during a maintenance window.

Platform/Infrastructure teams own the resolution.
Verify OrangeFS deployment and network reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OrangeFS component in the Linux kernel?

OrangeFS is a parallel file system designed for high-performance computing environments. Within the Linux kernel, it functions as a filesystem driver that allows the operating system to interact with these distributed storage resources. It is used primarily in clusters to manage large-scale data storage and retrieval, acting as the interface between the kernel and the storage network.

What does CVE-2026-72033 mean by an out-of-bounds read?

This vulnerability involves an integer overflow that results in a memory access error. When processing directory data, the kernel improperly calculates the size of an entry. By storing a large value into a smaller 32-bit container, the size wraps around to a small number, bypassing critical safety checks. This allows the system to read memory outside of the intended directory structure, which can cause the kernel to crash.

How can an attacker trigger this vulnerability?

An attacker needs to supply a specifically malformed directory entry to the kernel via the OrangeFS driver. Simply accessing or listing a normal directory does not trigger this flaw. The exploit relies on the kernel receiving data that contains an entry size engineered to trick the size-calculation logic into skipping validation. Without providing this crafted input, the kernel operates as expected.

Do I need to worry if my system is not internet-facing?

Halo Surface Signal indicates that public internet-facing reachability is very unlikely for this issue. Because OrangeFS is a kernel filesystem driver, it typically processes data from local storage or mounted shares rather than directly from the open internet. Most risks involve local access or the mounting of malicious filesystem sources, making it a lower priority for systems strictly behind standard network perimeters.

What are the first steps to address this CVE?

Start by identifying all infrastructure assets that have the OrangeFS kernel module loaded. Once you have a list of active deployments, evaluate whether these systems process untrusted directory data. If the software is in use, coordinate with your infrastructure or platform teams to plan for an update during your next scheduled maintenance window to ensure the kernel is patched against this memory safety issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.