High [CVE-2026-71221] Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
This high-severity Red Hat Linux advisory covers CVE-2026-71221 affecting Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
This vulnerability is assessed as Moderate impact because the unchecked height field enables a stack buffer overflow in savemeta, similar to the di_height OOB write in gfs2_edit. The attacker can overwrite stack memory beyond the fixed-size array, potentially achieving code execution.
While RHEL compiler hardening provides partial mitigation, the controlled out-of-bounds write makes exploitation plausible. Exploitation requires local access and user interaction (an administrator must run savemeta on the crafted image).
The vulnerability does not affect the kernel GFS2 driver, which validates i_height. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: gfs2-utils.src.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Do not run gfs2-utils savemeta on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.