CVE-2026-71224
published 2026-09-03CVE-2026-71224: A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk…
PriorityP418medium4.7CVSS 3.1
AVLACHPRNUIRSUCNINAH
EPSS
0.14%
3.2th percentile
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A stack overflow vulnerability was found in gfs2-utils.
ghsa_unreviewed·2026-09-03
CVE-2026-71224 [MEDIUM] CWE-770 A stack overflow vulnerability was found in gfs2-utils.
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
Red Hat
gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
vendor_redhat·2026-09-03·CVSS 4.7
CVE-2026-71224 [MEDIUM] CWE-770 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
Statement: This vulnerability is assessed as Moderate impact because the alloca-based stack exhaustion results in a process crash (SIGSEGV) rather than controlled memory corruption. RHEL stack guard pages prevent the overflow from reaching other memory regions, confining the impact to denial of service. Exploitation requires local access and user interaction (an administrator must run fsck.gfs2 or other gfs2-utils tools on a cr
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71224 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk [fedora-all]
bugzilla·2026-09-03·CVSS 4.7
CVE-2026-71224 [MEDIUM] CVE-2026-71224 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk [fedora-all]
CVE-2026-71224 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca((height + 1) * sizeof(*metalist)) where height is the i_height field from the on-disk inode (uint16, max 65535, valid range 0-10). No bounds validation is performed before the alloca call. An attacker can craft a GFS2 filesystem image with a large i_height value to cause excessive stack allocation (~1MB for i_height=65535 with sizeof(osi_list_t)=16), leading to stack exhaustion and a d
Bugzilla
CVE-2026-71224 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
bugzilla·2026-08-05·CVSS 4.7
CVE-2026-71224 [MEDIUM] CVE-2026-71224 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
CVE-2026-71224 gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
A flaw was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca((height + 1) * sizeof(*metalist)) where height is the i_height field from the on-disk inode (uint16, max 65535, valid range 0-10). No bounds validation is performed before the alloca call. An attacker can craft a GFS2 filesystem image with a large i_height value to cause excessive stack allocation (~1MB for i_height=65535 with sizeof(osi_list_t)=16), leading to stack exhaustion and a denial of service (SIGSEGV). The metadata walk in metawalk.c involves recursive traversal, and each level could invoke this alloca, compounding the stack usage. The Linux kernel GFS2 driver validates i_height against sd_max_height in gfs2_
2026-09-03
Published