CVE-2026-72033

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

fill_from_part() parses readdir trailer bytes relayed by pvfs2-client-core from an OrangeFS/PVFS server over the cluster network; a malicious or compromised server can supply crafted directory-entry lengths that reach the kernel during getdents on HPC client nodes without local shell access.

AC:LAttack complexity, low

An entry length near U32_MAX makes padlen truncate to a small __u32, reliably bypassing the bounds check and forcing the subsequent s[*len] probe; the attacker fully controls the trailer fields and no race, heap layout, or timing condition beyond readdir is required.

PR:NPrivileges required, none

A remote malicious OrangeFS/PVFS metadata server needs no account, capabilities, or namespaces on victim HPC compute nodes; once clients mount the filesystem, any process with directory read access can trigger parsing of attacker-supplied trailer bytes.

UI:NUser interaction, none

No victim interaction is required beyond normal automated directory scans (cron, parallel job launchers, monitoring); the attacker does not need a user to mount the filesystem or click anything—only pre-existing cluster mounts to the compromised server.

S:UScope, unchanged

The out-of-bounds read and resulting kernel oops occur entirely within the victim client's kernel address space during VFS readdir processing; there is no inherent crossing of VM, container, IOMMU, or sandbox security boundaries.

C:HConfidentiality impact, high

The integer truncation lets the kernel index gigabytes past the vzalloc readdir part buffer via s[*len], an unbounded out-of-bounds read over adjacent kernel memory before the fault; per CNA guidance OOB reads of this class are rated High.

I:HIntegrity impact, high

The bounds bypass is a memory-corruption class flaw that can reach beyond the allocated directory part into adjacent kernel heap; even though the immediate access is a read, CNA guidance rates such unchecked OOB probes as High integrity impact due to exploit chaining potential.

A:HAvailability impact, high

The maintainer confirmed the out-of-bounds read oopses the kernel; the inflated index can touch unmapped pages far outside the PART_SIZE-limited trailer buffer, causing a kernel fault, panic, or node crash on HPC clients during routine readdir.