CVE-2026-71219
Received Received - Intake

Stack Overflow in GFS2-utils Due to Unchecked di_depth

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-71219
EUVD
EUVD-2026-70447

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat gfs2-utils *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71219 is a stack overflow vulnerability in gfs2-utils, a package for managing the GFS2 filesystem. It occurs when the di_depth field from untrusted filesystem metadata is used to calculate a size for alloca() without proper bounds checking. This leads to excessive stack allocation, causing stack exhaustion and denial of service when processing a crafted GFS2 image with a large di_depth value.

Detection Guidance

Detecting this vulnerability requires examining GFS2 filesystem images for crafted metadata. Use fsck.gfs2, gfs2_edit, or savemeta on suspicious images to check for crashes or stack overflow errors. Monitor system logs for SIGSEGV errors from these utilities when processing GFS2 filesystems.

Impact Analysis

This vulnerability can cause denial of service by crashing tools like fsck.gfs2, gfs2_edit, or savemeta when they process a malicious GFS2 filesystem image. Exploitation requires local access and user interaction, such as an administrator running these tools on a crafted image. The impact is limited to these utilities and does not affect the kernel GFS2 driver.

Mitigation Strategies
  • Avoid running gfs2-utils tools on untrusted GFS2 filesystem images.
  • Disable automatic fsck.gfs2 execution at system boot for GFS2 filesystems.
  • Use ulimit -s to reduce the maximum stack size limit before running vulnerable utilities.
  • Process GFS2 images in isolated environments or containers to limit impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart