CVE-2026-71222: Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
A flaw was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is used as a loop count in savemeta.c and metawalk.c without bounds validation. The eanumptrs field is a u8 (max 255). Each iteration reads a pointer (8 bytes) plus name data. With eanumptrs=255 and a 512-byte block buffer, the loop reads up to 1384 bytes past the buffer boundary, causing a heap out-of-bounds read. This may disclose sensitive heap memory contents through tool output or error messages, and the significant over-read (2.7x the allocation) has a non-trivial probability of crossing a page boundary into unmapped memory, causing a crash.
Other sources
A heap out-of-bounds read vulnerability was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
— NVD
Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked eanumptrs in extended attribute processing
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use gfs2-utils to process a crafted GFS2 filesystem image are exposed. The affected parsing paths are in savemeta.c and metawalk.c during extended-attribute metadata handling.
What does an attacker need to exploit it?
An attacker needs to cause gfs2-utils to process GFS2 on-disk metadata with a malicious ea_num_ptrs value. The supplied severity vector indicates local attack access, no privileges required, and user interaction required.
What is the likely impact during processing?
The out-of-bounds read can expose heap memory through tool output or error messages. It can also crash the tool if the over-read crosses into an unmapped memory page.
How can I determine whether a filesystem image is maliciously formed?
Inspect the extended-attribute metadata for an ea_num_ptrs value that is not valid for the available block buffer. A value of 255 can drive reads far beyond a 512-byte block buffer.