CVE-2026-71220

CVE-2026-71220 is a stack out-of-bounds write (CWE-787) in gfs2-utils, the Linux utilities suite for the GFS2 shared-disk cluster filesystem. In the gfs2_edit tool, the di_height field taken from on-disk inode metadata is used as an array index without bounds checking, so a crafted or corrupted GFS2 filesystem image can overflow a stack buffer. An attacker who can induce a user to process such an image locally may gain arbitrary code execution, consistent with the CVSS vector (AV:L/AC:H/PR:N/UI:R). Exposure is limited to systems with gfs2-utils installed — typically enterprise Linux servers in GFS2 shared-storage clusters — since the flaw requires deliberately running gfs2_edit against a malicious image. No public proof-of-concept, CISA KEV listing, or known exploitation exists, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: No fixed version is given in the available data, so track Red Hat and distribution security advisories for gfs2-utils and apply the vendor's patched package as soon as it is released. Until then, avoid running gfs2_edit against untrusted or attacker-supplied GFS2 filesystem images. Confirm exposure by checking whether gfs2-utils is installed on cluster nodes (e.g., `rpm -q gfs2-utils` on RHEL systems).