CVE-2026-71222

Summary

A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.

Affected Software

Weaknesses

• CWE-125: Out-of-bounds Read

Workarounds

Do not process untrusted GFS2 filesystem images with gfs2-utils tools. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-71222
• https://bugzilla.redhat.com/show_bug.cgi?id=2511399

• ←Previous
• Next→