CVE-2026-71222

A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.

This vulnerability is assessed as Moderate impact because the ea_num_ptrs heap over-read is a read-only operation that cannot corrupt memory. The primary risk is information disclosure (heap memory contents leaked through tool output) and potential denial of service if the over-read crosses a page boundary. Exploitation requires local access and user interaction (an administrator must run a gfs2-utils tool on the crafted image). The vulnerability does not affect the kernel GFS2 driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted GFS2 filesystem images with gfs2-utils tools. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images.