CVE-2026-71221: Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
A flaw was found in gfs2-utils. In the savemeta function in savemeta.c, the height value from on-disk inode metadata controls a loop over a fixed-size stack array (10 elements) without bounds validation. An attacker can craft a GFS2 filesystem image with a height value exceeding 10 to write past the end of the array, corrupting adjacent stack memory. This is the same vulnerability class as the diheight OOB write in gfs2edit (extended.c) but in a different code path. The stack buffer overflow may allow arbitrary code execution when savemeta processes the crafted image. The Linux kernel GFS2 driver validates iheight against sdmaxheight in gfs2dinodein(), but the userspace gfs2-utils performs no equivalent validation.
Other sources
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
— NVD
Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the userspace gfs2-utils savemeta functionality to process GFS2 filesystem images are exposed. The Linux kernel GFS2 driver's validation of i_height does not provide equivalent protection for this userspace code path.
What must an attacker do to trigger the flaw?
An attacker needs to craft a GFS2 filesystem image containing inode metadata with a height value greater than 10, then have savemeta process that image. The unchecked value causes writes beyond a fixed 10-element stack array.
What is the likely impact if exploitation succeeds?
The out-of-bounds stack write can corrupt adjacent stack memory and may allow arbitrary code execution in the context of the process running savemeta.