CVE-2026-71221: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 7

This vulnerability in Red Hat Enterprise Linux 7's gfs2-utils involves a stack buffer overflow caused by an out-of-bounds write in the savemeta utility. The height value from on-disk inode metadata is used as a loop bound without validation, allowing an attacker to overwrite stack memory beyond a fixed-size array. This can lead to arbitrary code execution if an administrator runs savemeta on a crafted GFS2 filesystem image. The kernel's GFS2 driver validates the height field and is not vulnerable. Exploitation requires local access and user interaction, limiting the attack surface. Red Hat's compiler hardening partially mitigates the risk, but the vulnerability remains plausible to exploit. No official patch or fix has been announced yet, and Red Hat advises specific mitigations to reduce risk.

The vulnerability allows a local attacker with user interaction (administrator running savemeta) to cause a stack buffer overflow, potentially leading to arbitrary code execution with high confidentiality, integrity, and availability impact. The kernel GFS2 driver is unaffected, so the risk is limited to the gfs2-utils user-space tool. Exploitation requires crafted GFS2 filesystem images and local administrative action, reducing the likelihood of widespread exploitation. Red Hat compiler hardening provides partial mitigation but does not fully prevent exploitation.

Red Hat advises not to run gfs2-utils savemeta on untrusted or potentially compromised GFS2 filesystem images. When processing untrusted images, run gfs2-utils tools in containerized or VM-isolated environments. Additionally, disable automatic fsck at boot for GFS2 filesystems by setting fs_passno to 0 in /etc/fstab until official patches are released. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71221 for current remediation guidance.