Executive brief
gfs2-utils is a utility toolkit for managing GFS2 filesystems. A vulnerability in the tool can leak sensitive memory contents or crash the utility when processing maliciously crafted GFS2 filesystem images, but only if an administrator manually processes an untrusted filesystem.
Technical details
A heap out-of-bounds read (CWE-125) exists in gfs2-utils due to missing bounds validation on the ea_num_ptrs field from on-disk GFS2 extended attribute metadata. An attacker can craft a malicious GFS2 filesystem image that, when processed by gfs2-utils tools, triggers a heap buffer over-read. The vulnerability requires local access and user interaction (an administrator must explicitly run the tool on the crafted image). Exploitation can disclose sensitive memory contents through tool output or cause a denial-of-service crash if the over-read crosses a page boundary. The kernel GFS2 driver is not affected.
Affected products
- Red Hat gfs2-utils
Timeline
- 2026-09-03: disclosed