Log in Start free

Vulnerability · Published Sep 3, 2026 · Assigned by redhat

CVE-2026-71220Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

High 7.0

In plain English

A high-severity out-of-bounds write in Red Hat Enterprise Linux 7 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 97.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gfs2-utilsno fix listedDEBIAN-CVE-2026-71220
Debian:13gfs2-utilsno fix listedDEBIAN-CVE-2026-71220
Debian:14gfs2-utils3.6.1-2DEBIAN-CVE-2026-71220
Ubuntu:22.04:LTSgfs2-utilsno fix listedUBUNTU-CVE-2026-71220
Ubuntu:24.04:LTSgfs2-utilsno fix listedUBUNTU-CVE-2026-71220
Ubuntu:26.04:LTSgfs2-utilsno fix listedUBUNTU-CVE-2026-71220
Ubuntu:26.10gfs2-utilsno fix listedUBUNTU-CVE-2026-71220

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References