CVE-2026-71219
published 2026-09-03CVE-2026-71219: A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the…
PriorityP419medium4.7CVSS 3.1
AVLACHPRNUIRSUCNINAH
EPSS
0.14%
3.2th percentile
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux 7/8/9 Hash Table Traversal metawalk.c alloca di_depth stack-based overflow
vuldb·2026-09-23·CVSS 4.7
CVE-2026-71219 [MEDIUM] Red Hat Enterprise Linux 7/8/9 Hash Table Traversal metawalk.c alloca di_depth stack-based overflow
A vulnerability described as problematic has been identified in Red Hat Enterprise Linux 7/8/9. Affected by this issue is the function alloca of the file metawalk.c of the component Hash Table Traversal. Executing a manipulation of the argument di_depth can lead to stack-based buffer overflow.
This vulnerability is registered as CVE-2026-71219. The attack needs to be launched locally. No exploit is available.
GHSA
A stack overflow vulnerability was found in gfs2-utils.
ghsa_unreviewed·2026-09-03
CVE-2026-71219 [MEDIUM] CWE-770 A stack overflow vulnerability was found in gfs2-utils.
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
Red Hat
gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
vendor_redhat·2026-09-03·CVSS 7.4
CVE-2026-71219 [HIGH] CWE-770 gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
Statement: This vulnerability is assessed as Moderate impact because the alloca-based stack exhaustion results in a process crash (SIGSEGV) rather than controlled memory corruption. RHEL stack guard pages (1MB gap, post-CVE-2017-1000364) prevent the overflow from reaching heap or other mapped memory, confining the impact to denial
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71219 gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal [fedora-all]
bugzilla·2026-09-03·CVSS 5.5
CVE-2026-71219 [MEDIUM] CVE-2026-71219 gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal [fedora-all]
CVE-2026-71219 gfs2-utils: gfs2-utils: stack overflow via alloca(1= 31 on platforms where int is 32 bits, the expression 1 << di_depth invokes undefined behavior (signed integer overflow per C11 6.5.7p4), which may produce a small or wrapped alloca result rather than a large one, with unpredictable consequences.
The Linux kernel GFS2 driver validates i_depth in gfs2_dinode_in() (see CVE-2025-38710), but the userspace gfs2-utils performs no equivalent validation. This affects fsck.gfs2, gfs2_edit, and savemeta when processing directory metadata from crafted images.
Bugzilla
CVE-2026-71219 gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
bugzilla·2026-07-27·CVSS 4.7
CVE-2026-71219 [MEDIUM] CVE-2026-71219 gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
CVE-2026-71219 gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
*** This is a vulnerability report sent to us through https://issues.redhat.com/browse/PSIRTSUPT-17960 and was created using the PoC auto-triage agents. It contains hints on the vulnerability extracted by the IA and the full report. ALWAYS review it before any action. Once working on this, don't forget to also update the JSM ticket. ***
Six memory corruption vulnerabilities were found in gfs2-utils (the GFS2 filesystem utilities). All vulnerabilities are triggered by crafted GFS2 filesystem images and affect utilities that run as root. All findings were verified against upstream commit 8d07499.
The findings are:
1. Stack overflow via alloca(1<<di_depth) with unbounded depth value read
2026-09-03
Published