gfs2-utils CVE-2026-71222

Exploitation requires an attacker to supply a maliciously crafted GFS2 filesystem image to a user or process that will invoke gfs2-utils against it. The attack is local (AV:L): the crafted image must be accessible on the local system or a mounted share, and there is no network-facing attack surface against running systems. High complexity (AC:H) implies the crafted image must pass sufficient initial validation to reach the extended attribute parsing code path. User interaction (UI:R) is required - a person or automated job must explicitly execute a gfs2-utils command on the malicious image. Exploitation is therefore limited to contexts where untrusted GFS2 images are processed: forensic analysis workflows, cluster administrator maintenance operations, or automated filesystem repair pipelines ingesting externally sourced images. Default running GFS2 cluster nodes with no external image ingestion are not directly exposed.

The CVSS 5.3 Medium score with vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L accurately reflects a constrained attack profile. The local attack vector and high complexity - requiring a carefully crafted GFS2 image that passes enough initial filesystem validation to reach the vulnerable xattr parsing code - substantially limit opportunistic exploitation. User interaction (a privileged user or automated job must explicitly invoke a gfs2-utils command against the malicious image) provides a meaningful additional barrier beyond just system access. There is no CISA KEV listing, no public POC, and EPSS data is absent from the provided input. The High confidentiality impact reflects that heap memory disclosure could expose sensitive runtime data such as keys or credentials present in the process heap, but the compound prerequisites make active, widespread exploitation unlikely in the near term. No conflicting signals between the CVSS metrics and the vulnerability description are noted; the local vector and required user interaction are fully consistent with the crafted-image processing scenario described.

An attacker crafts a GFS2 filesystem image with a maliciously large ea_num_ptrs value in its extended attribute metadata structures. When a system administrator runs fsck.gfs2 or a similar gfs2-utils command against the image - for example during maintenance, forensic analysis, or an automated repair pipeline - the utility reads past the allocated heap buffer, potentially disclosing heap memory contents including sensitive data resident in the process. No public exploit code is known at this time.