# CVE-2026-71219: gfs2-utils stack overflow in metawalk.c

Source: https://junglewise.ai/threats/cve-2026-71219-gfs2-utils-stack-overflow-in-metawalk-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71219 · Severity: medium · CVSS 4.7 · Published 2026-09-03

gfs2-utils is a collection of utilities for managing GFS2 (Global File System 2) filesystems. A stack overflow vulnerability allows an attacker who can provide a crafted GFS2 filesystem image to cause a denial of service (process crash) when an administrator uses fsck.gfs2, gfs2_edit, or savemeta to access or repair the filesystem. The vulnerability requires local access and user interaction, and does not allow data corruption or system compromise.

## Quick answers

**Is CVE-2026-71219 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71219 being exploited in the wild.

**How severe is CVE-2026-71219?** Medium severity, with a CVSS score of 4.7, published 3 September 2026.

**Which products and versions are affected?** gfs2-utils gfs2-utils <UNKNOWN>.

**Is there a fix for CVE-2026-71219?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71219 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-71219?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack overflow caused by unbounded use of alloca() in the hash table traversal code in metawalk.c. The function allocates stack memory based on an exponentially-derived size from the untrusted on-disk di_depth field (2^di_depth) without validation, allowing a crafted filesystem image with an artificially large di_depth value to exhaust the stack. Exploitation requires local access and user interaction: an administrator must run one of the affected gfs2-utils tools on a malicious GFS2 filesystem image. The attack vector is local with high complexity and required user interaction. The impact is limited to denial of service (SIGSEGV crash) of the gfs2-utils process; RHEL stack guard pages prevent overflow from reaching heap or other memory regions. The underlying kernel GFS2 driver is not affected as it validates di_depth during mount.

## Affected products

- gfs2-utils gfs2-utils <UNKNOWN>

## Timeline

- 2026-09-03: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-71219](https://access.redhat.com/security/cve/CVE-2026-71219)