A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
CVE-2026-71224
CVSS base score
4.7 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-770
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
redhat enterprise linux
References
- access.redhat.com Vendor Advisory
- bugzilla.redhat.com Issue Tracking, Vendor Advisory