CVE-2026-71220
Received Received - Intake

Stack Out-of-Bounds Write in GFS2-Utils gfs2_edit

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-71220
EUVD
EUVD-2026-70448

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat gfs2-utils *
redhat gfs2-utils From 65536 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack out-of-bounds write vulnerability in gfs2-utils, specifically in the gfs2_edit tool. The di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow. This may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of gfs2-utils and monitoring for suspicious activity involving gfs2_edit. Inspect installed packages with commands like 'rpm -q gfs2-utils' or 'dpkg -l gfs2-utils'. Look for filesystem images processed by gfs2_edit from untrusted sources.

Impact Analysis

An attacker could exploit this by tricking an administrator into running gfs2_edit on a malicious GFS2 filesystem image. This could allow arbitrary code execution, potentially leading to system compromise. Exploitation requires local access and user interaction.

Mitigation Strategies
  • Avoid running gfs2_edit on untrusted GFS2 filesystem images.
  • Process filesystem images in isolated environments like containers or virtual machines.
  • Disable automatic fsck at boot for GFS2 filesystems until patches are applied.
  • Apply vendor-provided patches for gfs2-utils as soon as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart