gfs2-utils CVE-2026-71224

Exploitation requires that a user or automated process actively invoke a gfs2-utils tool (such as fsck.gfs2 or gfs2_edit) against an attacker-controlled GFS2 filesystem image, satisfying the UI:R user-interaction requirement from the CVSS vector. The attack is local (AV:L) and high-complexity (AC:H) because the attacker must craft a GFS2 image containing a specific malformed inode height field. No special system privileges are required of the attacker (PR:N), but the victim must actively open or scan the crafted image with a gfs2-utils utility. Systems that do not use GFS2, that restrict gfs2-utils to trusted internally generated images, or that do not have gfs2-utils installed are not at practical risk.

With a CVSS base score of 4.7 and vector AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, this vulnerability presents limited real-world risk. The attack is local, requires high complexity (a precisely crafted GFS2 image with a malformed inode height field), and mandates that a user or automated process actively invoke a gfs2-utils tool against the malicious image - making opportunistic or remote exploitation impractical. The impact is confined entirely to availability; there is no confidentiality or integrity exposure. Even a mid-sized municipal IT team in mielec running RHEL cluster nodes with GFS2 would face negligible exploitation likelihood given the absence of any public PoC, EPSS data, or CISA KEV listing. This is a legitimate but operationally low-priority finding that primarily threatens environments where externally sourced or untrusted GFS2 images are routinely processed by utility tools.

An attacker crafts a GFS2 filesystem image with a maliciously inflated inode height value embedded in the on-disk metadata and delivers it to a system administrator or automated fsck/backup job. When a gfs2-utils tool (such as fsck.gfs2) processes the image, the alloca() call in metawalk.c exhausts the stack and crashes the process, disrupting filesystem management or cluster maintenance operations.