CVE-2026-71221
Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
CVE-2026-71221- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-70449
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
EUVD-2026-70449- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6q6f-22jw-g823
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value...
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
GHSA-6q6f-22jw-g823- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
CVE-2026-71221- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-71221
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
DEBIAN-CVE-2026-71221- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-71221
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
UBUNTU-CVE-2026-71221- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-99900 No score
CVE-2026-71221 affecting package gfs2-utils 3.5.1-1
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
- Record
AZL-99900- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gfs2-utilsAzure Linux:3 |
through 3.5.1-1 | None known |
gfs2-utilsDebian:12 |
All versions, plus listed versions 3.5.0-23.5.1-13.5.1-23.6.0-13.6.1-13.6.1-2 |
None known |
gfs2-utilsDebian:13 |
All versions, plus listed versions 3.6.1-13.6.1-2 |
None known |
gfs2-utilsDebian:14 |
before 3.6.1-2, plus listed versions 3.6.1-1 |
3.6.1-2 |
gfs2-utilsUbuntu:16.04:LTS |
All versions, plus listed versions 3.1.6-0ubuntu23.1.6-0ubuntu3 |
None known |
gfs2-utilsUbuntu:18.04:LTS |
All versions, plus listed versions 3.1.9-2ubuntu1 |
None known |
gfs2-utilsUbuntu:20.04:LTS |
All versions, plus listed versions 3.2.0-23.2.0-3 |
None known |
gfs2-utilsUbuntu:22.04:LTS |
All versions, plus listed versions 3.3.0-23.4.1-2 |
None known |
gfs2-utilsUbuntu:24.04:LTS |
All versions, plus listed versions 3.5.1-1 |
None known |
gfs2-utilsUbuntu:26.10 |
All versions, plus listed versions 3.6.1-1build13.6.1-2ubuntu1 |
None known |
gfs2-utilsUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.1-13.6.1-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71221 is a high vulnerability (CVSS 7.0) in Red Hat Enterprise Linux 7, published September 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in gfs2-utils 3.6.1-2.