Quick answers
- Is CVE-2026-71220 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-71220 being exploited in the wild.
- How severe is CVE-2026-71220?
- High severity, with a CVSS score of 7, published 3 September 2026.
- Which products and versions are affected?
- Red Hat gfs2-utils.
- Is there a fix for CVE-2026-71220?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-71220 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-71220?
- Check whether you run Red Hat Gfs2-Utils. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stack out-of-bounds write (CWE-787) in gfs2_edit, where the di_height field from on-disk GFS2 inode metadata is used as an array index without bounds checking. This causes a controlled stack buffer overflow that can corrupt the stack, including return addresses. An attacker can craft a malicious GFS2 filesystem image to trigger the overflow. Exploitation requires local access and user interaction (an administrator must run gfs2_edit on the crafted image). The kernel GFS2 driver is not affected because it validates di_height against sd_max_height, but userspace tools are vulnerable. System hardening features (stack-protector, PIE, ASLR) provide partial mitigation but do not prevent exploitation.
Affected products
- Red Hat gfs2-utils
Timeline
- 2026-09-03: disclosed