CVE-2026-71222 is a heap out-of-bounds read vulnerability in gfs2-utils caused by unchecked consumption of the ea_num_ptrs field from on-disk extended attribute metadata. This leads to a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing specially crafted GFS2 filesystem images. Exploitation requires local access and user interaction, as an administrator must run gfs2-utils tools on the crafted image. The vulnerability affects only the user-space gfs2-utils tools and not the kernel GFS2 driver. The primary risks are information disclosure and denial of service due to memory over-read.

The vulnerability can lead to disclosure of sensitive heap memory contents, which may include cryptographic keys or other confidential data. It can also cause denial of service by crashing the gfs2-utils tool if the over-read crosses a memory page boundary. Exploitation requires local access and user interaction, limiting the attack vector. There is no impact on kernel integrity or code execution. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.3.

Red Hat advises not to process untrusted GFS2 filesystem images with gfs2-utils tools. When processing untrusted images, run gfs2-utils tools in containerized or VM-isolated environments to mitigate risk. No official patch information is provided in the advisory; therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.