CVE-2025-38065: orangefs: Do not truncate file size

Q: Which systems are most exposed?

The issue is relevant to 32-bit Linux systems using OrangeFS, where file sizes can be truncated at 4 GiB. Systems not using OrangeFS are not identified in the provided data as affected.

Q: What access does an attacker need?

The supplied CVSS vector indicates local attack access and low privileges are required. No user interaction is required.

Q: How can I assess whether a system may be affected?

Check whether the system is running a 32-bit Linux kernel, uses OrangeFS, and handles files larger than 4 GiB. The vulnerability is tied to truncation of file-size values at that boundary.

Published Jun 18, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

orangefs: Do not truncate file size

'len' is used to store the result of isizeread(), so making 'len' a sizet results in truncation to 4GiB on 32-bit systems.

Affected Software

10 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=4.6<5.4.294

Linux Linux kernel>=5.5<5.10.238

Linux Linux kernel>=5.11<5.15.185

Linux Linux kernel>=5.16<6.1.141

Linux Linux kernel>=6.2<6.6.93

Linux Linux kernel>=6.7<6.12.31

Linux Linux kernel>=6.13<6.14.9

Debian Debian Linux=11.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1

Event History

Jun 18, 2025

CVE Published

via MITRE·09:33 AM

Data Sourced

via MITRE·09:33 AM

DescriptionSeverity

Data Sourced

via NVD·10:15 AM

RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5973

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Which systems are most exposed?

The issue is relevant to 32-bit Linux systems using OrangeFS, where file sizes can be truncated at 4 GiB. Systems not using OrangeFS are not identified in the provided data as affected.

What access does an attacker need?

The supplied CVSS vector indicates local attack access and low privileges are required. No user interaction is required.

How can I assess whether a system may be affected?

Check whether the system is running a 32-bit Linux kernel, uses OrangeFS, and handles files larger than 4 GiB. The vulnerability is tied to truncation of file-size values at that boundary.

CVE-2025-38065: orangefs: Do not truncate file size

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which systems are most exposed?

What access does an attacker need?

How can I assess whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most exposed?

What access does an attacker need?

How can I assess whether a system may be affected?