CVE-2026-71221: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 7

This vulnerability involves a stack buffer overflow in the savemeta function of gfs2-utils on Red Hat Enterprise Linux 7. The issue arises because the height value extracted from on-disk inode metadata is used unchecked as a loop bound, causing an out-of-bounds write on the stack. Successful exploitation could lead to arbitrary code execution when processing maliciously crafted GFS2 filesystem images. The CVSS v3.1 score is 7.0, indicating high severity, with attack vector local, attack complexity high, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The Red Hat vendor advisory is referenced but does not provide explicit patch or remediation details in the input.

If exploited, this vulnerability could allow an attacker with local access to execute arbitrary code on the affected system by processing a crafted GFS2 filesystem image. The impact includes full compromise of confidentiality, integrity, and availability of the system due to the potential for arbitrary code execution via a stack buffer overflow.

The vendor advisory from Red Hat is available and should be consulted for the latest remediation guidance. Patch status is not explicitly confirmed in the provided data; therefore, users should check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71221 for official fixes or workarounds. Until a patch is applied, avoid processing untrusted GFS2 filesystem images to mitigate risk.