{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "480e3e532e31666a18520a7964bb4095d7a16b9a"
            },
            {
              "fixed": "1679780f482feeb82acb5995587d4fb1d1fe82fd"
            },
            {
              "fixed": "a72bbb43689591c9d36e3bb45c2d4e688cf92682"
            },
            {
              "fixed": "36723b28e3293047f087f4501f1ef4ead418dd84"
            },
            {
              "fixed": "07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9"
            },
            {
              "fixed": "fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1"
            },
            {
              "fixed": "82fc886e244c76fadf05ef1958aaf8815478ccde"
            },
            {
              "fixed": "e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729"
            },
            {
              "fixed": "18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.12.0"
            },
            {
              "fixed": "5.10.261"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.212"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.178"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.145"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.97"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.40"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72033.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: keep the readdir entry size 64-bit in fill_from_part()\n\nfill_from_part() computes the size of a directory entry in size_t but\nstores it in a __u32. An entry length near U32_MAX wraps it to a small\nvalue, bypasses the bounds check, and is then used to index the entry,\nreading far past the directory part -- an out-of-bounds read that oopses\nthe kernel.\n\nCompute the size as a u64 so it cannot truncate; the bounds check then\nrejects the entry. The trailer is supplied by the userspace client.",
  "id": "CVE-2026-72033",
  "modified": "2026-08-18T03:31:22.529184378Z",
  "published": "2026-08-15T05:51:55.102Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72033.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72033"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "orangefs: keep the readdir entry size 64-bit in fill_from_part()"
}