EUVD-2026-70447
GHSA-5ggp-489g-rjqr
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
No bounds check means any large di_depth triggers the overflow, making AC:L; UI:R and AV:L retained because a user must explicitly run the tool against a crafted local image.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
AnalysisAI
Stack exhaustion in gfs2-utils allows an attacker who can deliver a crafted GFS2 filesystem image to crash fsck.gfs2, gfs2_edit, or savemeta on Red Hat Enterprise Linux 7, 8, and 9. The root cause is unbounded use of alloca() in metawalk.c's hash table traversal, where the allocation size is derived exponentially from the on-disk di_depth field with no upper-bound check, so a sufficiently large di_depth value causes the process stack to be fully consumed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must be able to deliver or make accessible a crafted GFS2 filesystem image containing a manipulated di_depth inode field - this requires some level of write access to storage or delivery of the image to the target host; (2) a user or automated job must explicitly invoke fsck.gfs2, gfs2_edit, or savemeta against the crafted image (UI:R), meaning routine passive operation is not sufficient; (3) the host must be running a vulnerable version of gfs2-utils on RHEL 7, 8, or 9. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is constrained by several factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the gfs2-utils update when Red Hat releases a patched package for RHEL 7, 8, or 9; no specific fixed version is confirmed in the available intelligence (check https://access.redhat.com/security/cve/CVE-2026-71219 and https://bugzilla.redhat.com/show_bug.cgi?id=2507750 for current patch status). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 7
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today