gfs2-utils CVE-2026-71220

Exploitation unconditionally requires a user to locally execute gfs2_edit and supply the crafted GFS2 image as input - user interaction (UI:R) is mandatory and cannot be bypassed remotely. The vulnerability is triggered purely by parsing the on-disk inode structure within the image; no GFS2 kernel mount is required. The attacker must control or influence the content of the GFS2 image file presented to the victim, whether through a shared storage system, a social engineering delivery, or a supply-chain compromise of backup media. No host authentication is required on the part of the attacker (PR:N) since the malicious content is embedded in the image file itself. Exploitation is limited by high attack complexity (AC:H): modern RHEL builds enable stack canaries (SSP) and ASLR by default, making reliable control-flow hijacking from a stack overflow substantially harder. There is no remote attack vector - AV:L is confirmed by the CVSS vector.

The CVSS 3.1 score of 7.0 with vector AV:L/AC:H/PR:N/UI:R accurately captures the exploitation profile: the attack is local, requires user interaction to execute gfs2_edit against a malicious image, and achieving reliable code execution from a stack overflow on modern RHEL (with stack canaries, ASLR, and NX enforced by default) is non-trivial, justifying AC:H. The theoretical impact ceiling of C:H/I:H/A:H applies if exploitation succeeds, but real-world risk is tempered by the complexity bar. No EPSS score was provided in the input data, and this CVE is not listed in CISA KEV; no public proof-of-concept has been identified. The primary exposed population is storage administrators and cluster operators who routinely use gfs2_edit to inspect or repair GFS2 images - even a mid-sized municipal IT team in koszalin managing a clustered RHEL environment should treat this as an actionable patch-cycle item given that a single malicious filesystem image delivered via a shared storage array or backup medium could reach a privileged operator's session. The absence of a remote attack path significantly limits blast radius compared to network-exploitable vulnerabilities of equivalent CVSS impact.

An attacker crafts a GFS2 filesystem image containing an inode with an oversized di_height value exceeding the stack buffer dimensions in gfs2_edit. The image is delivered to a storage administrator - via a shared SAN volume, a backup archive, or a support ticket requesting diagnostic analysis - who then executes gfs2_edit against it as part of routine maintenance. The stack overflow overwrites the saved return address, and with sufficient crafting effort to defeat stack canaries and ASLR, the attacker achieves code execution in the context of the gfs2_edit process.