CVE-2026-71224
Received Received - Intake

Stack Overflow in GFS2-utils Due to Unbounded Alloca

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: redhat-SADP

Description
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-71224
EUVD
EUVD-2026-70451

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat gfs2-utils *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71224 is a stack overflow vulnerability in gfs2-utils where the metadata walk code in metawalk.c uses alloca() with an untrusted inode height value without bounds validation. This causes stack exhaustion and denial of service when processing crafted GFS2 filesystem images.

Detection Guidance

To detect this vulnerability, monitor for crashes in gfs2-utils tools like fsck.gfs2 when processing GFS2 filesystem images. Check for SIGSEGV errors in logs. Validate filesystem images before processing them with tools like fsck.gfs2 -n to test without modifications.

Impact Analysis

This vulnerability can cause a denial of service by crashing gfs2-utils tools like fsck.gfs2 when processing malicious GFS2 filesystem images. Exploitation requires local access and user interaction, such as running affected tools on a crafted filesystem.

Mitigation Strategies

Run gfs2-utils tools in isolated environments or containers. Disable automatic fsck at boot for GFS2 filesystems. Reduce stack size limits using ulimit -s to minimize impact of stack overflow. Avoid running these tools on untrusted filesystem images.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71224. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart