CVE-2026-71220
published 2026-09-03CVE-2026-71220: A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index…
PriorityP335high7CVSS 3.1
AVLACHPRNUIRSUCHIHAH
EPSS
0.17%
6.1th percentile
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux gfs2_edit stack-based overflow
vuldb·2026-09-23·CVSS 7.0
CVE-2026-71220 [HIGH] Red Hat Enterprise Linux gfs2_edit stack-based overflow
A vulnerability identified as very critical has been detected in Red Hat Enterprise Linux. This impacts an unknown function of the component gfs2_edit. This manipulation causes stack-based buffer overflow.
This vulnerability is tracked as CVE-2026-71220. The attack is restricted to local execution. No exploit exists.
GHSA
A stack out-of-bounds write vulnerability was found in gfs2-utils.
ghsa_unreviewed·2026-09-03
CVE-2026-71220 [HIGH] CWE-787 A stack out-of-bounds write vulnerability was found in gfs2-utils.
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
Red Hat
gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
vendor_redhat·2026-09-03·CVSS 7.0
CVE-2026-71220 [HIGH] CWE-787 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
Statement: This vulnerability is assessed as Moderate impact because the unchecked di_height field enables a controlled stack buffer overflow in gfs2_edit. The attacker controls the array index and can overwrite the return address on the stack, potentially achieving code execution. While RHEL compiler hardening (-fstack-protector-strong, PIE, ASLR) provides partial mitigation, the controlled nature of the
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71220 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit [fedora-all]
bugzilla·2026-09-03·CVSS 7.0
CVE-2026-71220 [HIGH] CVE-2026-71220 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit [fedora-all]
CVE-2026-71220 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in gfs2-utils. In the gfs2_edit tool, the metapath_to_lblock() function in extended.c uses the di_height field from on-disk inode metadata as an array index into a fixed-size stack array factor[GFS2_MAX_META_HEIGHT] (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with di_height exceeding 10 (up to 65535) to write past the end of the array, corrupting adjacent stack memory including saved registers an
Bugzilla
CVE-2026-71220 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
bugzilla·2026-08-05·CVSS 7.0
CVE-2026-71220 [HIGH] CVE-2026-71220 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
CVE-2026-71220 gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
A flaw was found in gfs2-utils. In the gfs2_edit tool, the metapath_to_lblock() function in extended.c uses the di_height field from on-disk inode metadata as an array index into a fixed-size stack array factor[GFS2_MAX_META_HEIGHT] (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with di_height exceeding 10 (up to 65535) to write past the end of the array, corrupting adjacent stack memory including saved registers and the return address. The subsequent loop (factor[h] = factor[h+1] * sbd.sd_inptrs) amplifies the corruption by writing additional entries past the array boundary. This is a classic stack buffer overflow that may allow arbitrary code exec
2026-09-03
Published