CVE-2026-71221

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

This vulnerability is assessed as Moderate impact because the unchecked height field enables a stack buffer overflow in savemeta, similar to the di_height OOB write in gfs2_edit. The attacker can overwrite stack memory beyond the fixed-size array, potentially achieving code execution. While RHEL compiler hardening provides partial mitigation, the controlled out-of-bounds write makes exploitation plausible. Exploitation requires local access and user interaction (an administrator must run savemeta on the crafted image). The vulnerability does not affect the kernel GFS2 driver, which validates i_height.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run gfs2-utils savemeta on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab.