In the Linux kernel’s orangefs module, the code that prepares client debug masks incorrectly calculates the length of a keyword up to a space but then parses the keyword using a format specifier that discards leading whitespace. If a debug entry begins with a leading space, the allocated buffer is too small for the actual keyword, and a subsequent string copy overruns the buffer. This out‑of‑bounds write corrupts kernel memory and, because it occurs in the kernel, can be leveraged by an attacker to execute arbitrary code, crash the system, or elevate privileges. The vulnerability is a classic memory overwrite (CWE‑120).

The affected systems are any Linux kernel installations that include the orangefs module and have not yet applied the upstream patch referenced in the commit logs. Since the advisory lists the broad Linux kernel CPE, every distribution running a kernel version before the fix is considered vulnerable. No specific vendor or version details are supplied.

The overall risk is high with an EPSS score of less than 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.8 indicates high severity. Exploitation requires a user space, suggesting a local or privileged‑user attack vector. Based on the description, it is inferred that an attacker could trigger an out‑of‑bounds write by supplying a malformed debug entry, potentially leading to kernel memory corruption that might permit privilege escalation or system instability. No public exploits are known that would allow a local attacker to gain administrative privileges or destabilize the system.