CVE-2026-71222
Received Received - Intake

Heap Out-of-Bounds Read in GFS2-Utils

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-71222
EUVD
EUVD-2026-70450

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat gfs2-utils *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71222 is a heap out-of-bounds read vulnerability in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is processed without bounds validation, causing a heap buffer over-read. This may expose sensitive memory contents or crash the system when handling specially crafted GFS2 filesystem images.

Detection Guidance

Detecting this vulnerability requires checking for untrusted GFS2 filesystem images processed by gfs2-utils tools. Monitor system logs for crashes or errors when using gfs2-utils commands like gfs2_edit or fsck.gfs2. Inspect extended attribute processing in savemeta.c and metawalk.c for suspicious buffer over-reads.

Impact Analysis

The vulnerability allows attackers with local access to read sensitive memory contents or cause a crash by processing malicious GFS2 filesystem images. Exploitation requires user interaction, such as an administrator running a gfs2-utils tool on the crafted image. The primary risks are information disclosure and potential denial of service.

Mitigation Strategies

Avoid processing untrusted GFS2 filesystem images. Use isolated environments like containers or VMs for handling suspicious images. Ensure gfs2-utils is updated to the latest patched version. Restrict access to gfs2-utils tools to trusted administrators only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart