CVE-2025-38065

What it actually does

The vulnerability stems from assigning the result of i_size_read() to a size_t variable named 'len' in the orangefs filesystem code, causing the file size value to be truncated to 32 bits (maximum 4GiB) on 32-bit systems.

Why it matters to the business

Organizations running 32-bit Linux kernels with orangefs may experience silent data corruption, incorrect file size reporting, or unexpected truncation behavior when handling files larger than 4GiB, potentially affecting storage reliability and application correctness across large deployments.

How an attack unfolds

An attacker with the ability to trigger file size operations on orangefs (for example via crafted I/O or metadata manipulation) can cause the kernel to misinterpret file lengths beyond 4GiB on 32-bit systems; listed threat actors associated with Linux kernel privilege-escalation campaigns could chain this truncation flaw with other kernel issues to influence memory or file handling logic.

How to fix it

Upgrade the Linux kernel to the fixed commit ceaf195ed285b77791e29016ee6344b3ded609b3 or later stable releases containing the orangefs size handling correction; for Mageia 5 systems apply bind package version 9.10.3.P3-1.mga5 or newer if applicable.

How to confirm the fix worked

Confirm the running kernel contains commit ceaf195ed285b77791e29016ee6344b3ded609b3, verify i_size_read() results are stored in an appropriately sized type (loff_t), and test file size operations on 32-bit systems with files larger than 4GiB.

Typical attack path

1. Identify 32-bit Linux system using orangefs filesystem
2. Perform operations that invoke i_size_read() on files exceeding 4GiB
3. Trigger truncation of the size value to 32 bits
4. Leverage resulting incorrect size for further manipulation or combined with other kernel flaws

How to detect it

Examine kernel logs and orangefs-related syscalls for file size anomalies exceeding 4GiB on 32-bit architectures; correlate with any listed advanced spyware or privilege-escalation campaigns targeting the Linux kernel.

What your security team should do

• Prioritize kernel upgrades on all 32-bit systems using orangefs within the next maintenance window
• Review and restrict orangefs usage on 32-bit platforms where possible
• Monitor EPSS trend and threat actor activity for any increase in exploitation attempts