CVE-2026-71219 is a stack overflow vulnerability in gfs2-utils where the hash table traversal code in metawalk.c uses alloca() with a size derived exponentially from the untrusted on-disk di_depth field without bounds checking. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion leading to a denial of service (process crash) when processed by fsck.gfs2, gfs2_edit, or savemeta. The vulnerability requires local access and user interaction, and the kernel GFS2 driver is not affected as it validates di_depth. Red Hat notes that stack guard pages prevent overflow beyond the stack, confining impact to denial of service.

The vulnerability results in denial of service by causing stack exhaustion and process crash (SIGSEGV) in gfs2-utils tools when processing maliciously crafted GFS2 filesystem images. There is no confidentiality or integrity impact. Exploitation requires local access and user interaction by an administrator running affected tools. The kernel GFS2 driver is not vulnerable. The impact is limited to denial of service against the gfs2-utils process.

Run gfs2-utils tools in containerized or VM-isolated environments when handling untrusted GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems by setting fs_passno to 0 in /etc/fstab until patches are applied. Use 'ulimit -s' to reduce stack size limits to convert potential exploitation into a controlled crash. Check vendor advisories for patch availability and apply official fixes when released.