Security readout for executives and security teams
Plain-English summary
A Linux OrangeFS flaw can misread file sizes larger than 4 GiB on 32-bit systems because a value is stored in a type that is too small. This may cause incorrect file handling. The supplied CVSS rating is 7.8, although the public description does not establish the precise path to confidentiality, integrity, and availability loss.
Executive priority
Prioritize remediation for 32-bit systems actively using OrangeFS; broader emergency action is not supported by the supplied evidence. The high CVSS score warrants timely patching, but exposure is configuration-dependent and active exploitation is not reported. Ask infrastructure teams for an inventory and distributor-confirmed patch status.
Technical view
The OrangeFS kernel code stored the result of i_size_read() in a size_t. On 32-bit systems, that type can truncate a larger file size at the 4 GiB boundary. Linux stable commits change the handling to preserve the file size. The supplied record identifies local, low-privilege attack conditions, but provides no trigger or impact-chain details.
Likely exposure
Exposure appears limited to affected 32-bit Linux kernels where OrangeFS is present and used, particularly with files exceeding 4 GiB. Systems running only 64-bit kernels or not using OrangeFS are less likely to encounter the described condition. The supplied version list is ambiguous, so distributor-specific package status should determine applicability.
Exploitation context
The supplied record is not listed in KEV, and no cited source reports active exploitation or a public exploit. The CVSS vector describes local access with low privileges and no user interaction. Treat exploitation status as unconfirmed rather than assuming the flaw is being used in attacks.
Researcher notes
The central condition is integer-width truncation of i_size_read() output on 32-bit systems. The bundle does not identify a CWE, demonstrate memory corruption, explain the full security impact, or provide reliable affected-version ranges. Validate against the relevant stable commit and distributor backport rather than relying solely on upstream version numbers.
Mitigation direction
- Install a supported vendor kernel containing the applicable Linux stable fix.
- Prioritize affected 32-bit hosts that actively mount or use OrangeFS.
- Consult Linux distributor advisories to map patched kernel package versions accurately.
- If updates are delayed, avoid affected OrangeFS workloads involving files larger than 4 GiB.
Validation and detection
- Inventory kernel architecture and version across systems using OrangeFS.
- Confirm whether OrangeFS is installed, mounted, or operationally required.
- Check distributor package advisories for explicit CVE-2025-38065 remediation status.
- After updating, verify the running kernel matches the installed patched package.
- Safely test large-file handling in a non-production OrangeFS environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38065 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ceaf195ed285b77791e29016ee6344b3ded609b3CVE reference, Linux
- https://git.kernel.org/stable/c/341e3a5984cf5761f3dab16029d7e9fb1641d5ffCVE reference, Linux
- https://git.kernel.org/stable/c/5111227d7f1f57f6804666b3abf780a23f44fc1dCVE reference, Linux
- https://git.kernel.org/stable/c/15602508ad2f923e228b9521960b4addcd27d9c4CVE reference, Linux
- https://git.kernel.org/stable/c/121f0335d91e46369bf55b5da4167d82b099a166CVE reference, Linux
- https://git.kernel.org/stable/c/cd918ec24168fe08c6aafc077dd3b6d88364c5cfCVE reference, Linux
- https://git.kernel.org/stable/c/2323b806221e6268a4e17711bc72e2fc87c191a3CVE reference, Linux
- https://git.kernel.org/stable/c/062e8093592fb866b8e016641a8b27feb6ac509dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.