CVE-2026-71222
published 2026-09-03CVE-2026-71222: A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds…
PriorityP426medium6.3CVSS 3.1
AVLACHPRNUIRSUCHINAH
EPSS
0.14%
3.0th percentile
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux gfs2-utils out-of-bounds
vuldb·2026-09-23·CVSS 6.3
CVE-2026-71222 [MEDIUM] Red Hat Enterprise Linux gfs2-utils out-of-bounds
A vulnerability marked as problematic has been reported in Red Hat Enterprise Linux. Affected by this vulnerability is an unknown functionality of the component gfs2-utils. Performing a manipulation results in out-of-bounds read.
This vulnerability is cataloged as CVE-2026-71222. The attack must be initiated from a local position. There is no exploit available.
GHSA
A heap out-of-bounds read vulnerability was found in gfs2-utils.
ghsa_unreviewed·2026-09-03
CVE-2026-71222 [MEDIUM] CWE-125 A heap out-of-bounds read vulnerability was found in gfs2-utils.
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
Red Hat
gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
vendor_redhat·2026-09-03·CVSS 5.3
CVE-2026-71222 [MEDIUM] CWE-125 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
Statement: This vulnerability is assessed as Moderate impact because the ea_num_ptrs heap over-read is a read-only operation that cannot corrupt memory. The primary risk is information disclosure (heap memory contents leaked through tool output) and potential denial of service if the over-read crosses a page boundary. Exploitation requires local access and user interaction (an adm
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71222 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-71222 [MEDIUM] CVE-2026-71222 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing [fedora-all]
CVE-2026-71222 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is used as a loop count in savemeta.c and metawalk.c without bounds validation. The ea_num_ptrs field is a __u8 (max 255). Each iteration reads a pointer (8 bytes) plus name data. With ea_num_ptrs=255 and a 512-byte block buffer, the loop reads up to 1384 bytes past the buffer boundary, causing a heap out-of-bounds read. This may disclose sen
Bugzilla
CVE-2026-71222 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-71222 [MEDIUM] CVE-2026-71222 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
CVE-2026-71222 gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
A flaw was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is used as a loop count in savemeta.c and metawalk.c without bounds validation. The ea_num_ptrs field is a __u8 (max 255). Each iteration reads a pointer (8 bytes) plus name data. With ea_num_ptrs=255 and a 512-byte block buffer, the loop reads up to 1384 bytes past the buffer boundary, causing a heap out-of-bounds read. This may disclose sensitive heap memory contents through tool output or error messages, and the significant over-read (2.7x the allocation) has a non-trivial probability of crossing a page boundary into unmapped memory, causing a crash.
2026-09-03
Published