The vulnerability is in the OrangeFS filesystem support in the Linux kernel. fill_from_part() calculates an entry's length with a 64‑bit size_t but mistakenly stores the value in a 32‑bit field. When an entry length approaches the maximum 32‑bit value, the truncation produces an unexpectedly small size. The bounds check that follows the truncation is thereby bypassed, and an index is derived from this small value. The kernel then reads past the intended buffer, culminating in an out‑of‑bounds read that oopses the kernel. The primary consequence is a kernel crash, which translates to a denial‑of‑service for the affected system.

This flaw is confined to the Linux kernel's OrangeFS module. All distributions that ship the patched module remain vulnerable unless their kernel has been upgraded past the commits that fix the truncation bug. No particular kernel release is listed as affected in the information provided.

The CVSS score is 9.8, and the EPSS score is < 1%, so the exact exploitation probability is unclear. Based on the description, it is inferred that the attacker would need to have either local access or a way to control an OrangeFS readdir operation, for example by mounting the filesystem or influencing the size of directory entries. Because the bug triggers only when a size close to U32_MAX is presented, crafting an exploit may be non‑trivial, suggesting a moderate to low likelihood of widespread use. Nevertheless, a kernel crash is a high‑impact outcome and the vulnerability is not listed in the CISA KEV catalog. It remains advisable to treat this as a high‑severity kernel bug.