O_DIRECT is a Linux file I/O flag that asks the kernel to move data directly between an application and the storage device, bypassing the page cache. In normal buffered I/O, the kernel may hold file data in memory and delay writes; O_DIRECT is used when an application wants tighter control over latency, caching, or data consistency.
In security work, O_DIRECT matters because it changes how file writes interact with filesystem internals. Direct I/O can expose timing windows and corner cases that buffered writes do not, especially in filesystems with copy-on-write, reflink, or block-sharing logic. Attackers may abuse those paths to create races or force unexpected block updates, while defenders use the same knowledge to test for kernel flaws, audit filesystem features, and understand which workloads can trigger storage-layer bugs. O_DIRECT is not dangerous by itself, but it can become part of a reliable exploit condition when a filesystem mishandles concurrent direct writes.