CVE-2026-71224: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 7

This vulnerability is caused by the metadata walk code in metawalk.c of gfs2-utils using alloca() with an untrusted inode height value from on-disk metadata without validating bounds. This can cause stack exhaustion and denial of service (process crash via SIGSEGV) when processing crafted GFS2 filesystem images. The impact is limited to denial of service due to stack guard pages preventing overflow into other memory regions. Exploitation requires local access and user interaction, specifically an administrator running fsck.gfs2 or other gfs2-utils tools on a crafted filesystem image. The kernel GFS2 driver validates inode height and is not affected. Red Hat classifies this as moderate impact with a CVSS 3.1 score of 4.7 (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H).

The vulnerability causes denial of service through stack exhaustion leading to process crashes (SIGSEGV) when processing malicious GFS2 filesystem images with gfs2-utils tools. There is no impact on confidentiality or integrity. Exploitation requires local access and user interaction by an administrator running affected tools. The kernel driver is unaffected, limiting the scope to user-space utilities.

No official patch or fix is currently confirmed. Red Hat recommends running gfs2-utils tools in containerized or VM-isolated environments when handling untrusted GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems by setting fs_passno to 0 in /etc/fstab. Additionally, reduce the stack size limit using 'ulimit -s' to convert potential exploitation into a controlled crash. Monitor the Red Hat advisory for updates on patches or official fixes.