CVE-2026-71220

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

This vulnerability is assessed as Moderate impact because the unchecked di_height field enables a controlled stack buffer overflow in gfs2_edit. The attacker controls the array index and can overwrite the return address on the stack, potentially achieving code execution. While RHEL compiler hardening (-fstack-protector-strong, PIE, ASLR) provides partial mitigation, the controlled nature of the out-of-bounds write makes exploitation plausible. Exploitation requires local access and user interaction (an administrator must run gfs2_edit on the crafted image). The vulnerability does not affect the kernel GFS2 driver, which validates di_height against sd_max_height.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run gfs2_edit on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab.