CVE-2026-71220: Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
A flaw was found in gfs2-utils. In the gfs2edit tool, the metapathtolblock() function in extended.c uses the diheight field from on-disk inode metadata as an array index into a fixed-size stack array factor[GFS2MAXMETAHEIGHT] (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with diheight exceeding 10 (up to 65535) to write past the end of the array, corrupting adjacent stack memory including saved registers and the return address. The subsequent loop (factor[h] = factor[h+1] sbd.sdinptrs) amplifies the corruption by writing additional entries past the array boundary. This is a classic stack buffer overflow that may allow arbitrary code execution when gfs2edit processes the crafted image. The Linux kernel GFS2 driver validates diheight against sdmaxheight in gfs2dinodein(), but the userspace gfs2-utils performs no equivalent validation.
Other sources
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
— NVD
Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked diheight in gfs2edit
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when gfs2_edit processes a crafted GFS2 filesystem image. The attacker needs to provide an image containing inode metadata with an oversized di_height value and have a user process that image with the vulnerable userspace tool.
Does the Linux kernel's GFS2 validation protect gfs2_edit?
No. The kernel GFS2 driver validates di_height against sd_max_height, but gfs2-utils does not perform equivalent validation in the affected gfs2_edit code path.
What can be done before a fix is available?
Do not run gfs2_edit against untrusted or externally supplied GFS2 filesystem images. Treat images with inode di_height values greater than 10 as unsafe for processing by the affected tool.