In the Linux kernel’s orangefs module, the code that prepares client debug masks incorrectly calculates the buffer size for debug keywords. It measures the length of a keyword up to a space but then parses the keyword using a format specifier that discards leading whitespace. If a debug entry begins with a leading space, the allocated buffer is too small for the actual keyword, and a subsequent string copy overruns the buffer. This out‑of‑bounds write corrupts kernel memory and, because it occurs in the kernel, can be leveraged by an attacker with the appropriate level of access to execute arbitrary code, crash the system, or potentially elevate privileges. The vulnerability is a classic memory overwrite (CWE‑120).

The affected systems are any Linux kernel installations that include the orangefs module and have not yet applied the upstream patch referenced in the commit logs. Since the advisory lists the broad Linux kernel CPE, every distribution running a kernel version before the fix is considered vulnerable. No specific vendor or version details are supplied.

The overall risk is moderate with an EPSS score of < 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.6 indicates moderate severity. Exploitation requires a user to supply a debug mask entry with a leading space, suggesting a local or privileged‑user attack vector. Based on the description, it is inferred that an attacker could trigger an out‑of‑bounds write by supplying a malformed debug entry, potentially leading to kernel memory corruption that might permit privilege escalation or system instability. No public could be leveraged by a local attacker to gain administrative privileges or destabilize the system.