CVE-2026-71219: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 7

This vulnerability in gfs2-utils involves a stack overflow caused by the use of alloca() with an exponentially large size derived from the untrusted di_depth field in the GFS2 filesystem image. The lack of bounds checking allows a crafted filesystem image with a large di_depth value to exhaust the stack, resulting in a denial of service via process crash (SIGSEGV) when tools such as fsck.gfs2, gfs2_edit, or savemeta process the image. The kernel GFS2 driver validates di_depth and is not vulnerable. Exploitation requires local administrator privileges and user interaction. Red Hat's stack guard pages prevent overflow beyond the stack, limiting impact to denial of service. No official patch or fix is currently available according to the vendor advisory. Recommended mitigations include running these tools in containerized or VM-isolated environments, disabling automatic filesystem checks at boot, and limiting stack size with ulimit.

The vulnerability causes denial of service by crashing gfs2-utils processes that handle crafted GFS2 filesystem images. It does not lead to memory corruption or privilege escalation. Exploitation requires local access and user interaction by an administrator running affected tools. The kernel driver is unaffected, so the vulnerability does not impact kernel-level operations or remote exploitation. The impact is confined to denial of service against the gfs2-utils process.

No official fix or patch is currently available. Red Hat recommends running gfs2-utils tools in containerized or VM-isolated environments when processing untrusted or potentially compromised GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems by setting fs_passno to 0 in /etc/fstab. Additionally, reduce the stack size limit using 'ulimit -s' to convert potential exploitation into a controlled crash. Monitor Red Hat advisories for updates on patch availability.