Stack Out-of-Bounds Write in gfs2-utils

A stack out-of-bounds write vulnerability, tracked as CVE-2026-71220, exists within the gfs2_edit utility provided by the gfs2-utils package. The flaw is triggered when the application processes a GFS2 filesystem image containing malicious inode metadata. Specifically, the di_height field from the on-disk inode is utilized as an array index without sufficient bounds checking. By providing a specially crafted filesystem image, an attacker can cause a stack buffer overflow. This condition potentially permits an attacker to achieve arbitrary code execution on systems that process untrusted GFS2 images using the gfs2_edit tool. This vulnerability is significant for system administrators and security teams managing storage environments where integrity of filesystem metadata is critical.

Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution on the target system, potentially resulting in full system compromise. The impact is limited to systems where privileged users run gfs2_edit against untrusted or maliciously crafted GFS2 filesystem images.

Recommendation

Prioritize patching of the gfs2-utils package across all Linux distributions where GFS2 filesystems are managed. Monitor system logs for unexpected execution of the gfs2_edit binary, particularly in environments where automated storage auditing or forensic analysis occurs. Organizations should restrict access to gfs2_edit to authorized personnel only and avoid running it on filesystem images of unknown or untrusted origin.