[From nobody Tue Oct 6 20:35:11 2026 Received: (at submit) by bugs.debian.org; 4 Sep 2026 17:33:05 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 50; hammy, 148; neutral, 65; spammy, 2. spammytokens:0.940-+--H*r:bugs.debian.org, 0.909-+--limited hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1x2Xmg-006L7q-0u for submit@bugs.debian.org; Fri, 04 Sep 2026 17:33:05 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: gfs2-utils: CVE-2026-71219 CVE-2026-71220 CVE-2026-71221 CVE-2026-71222 CVE-2026-71223 CVE-2026-71224 Message-ID: <178854318251.928789.4863809694077681163.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Fri, 04 Sep 2026 19:33:02 +0200 Delivered-To: submit@bugs.debian.org Source: gfs2-utils Version: 3.6.1-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for gfs2-utils. Unfortunately the available information right now is limited to what we have in the references referring to Red Hat's bugzilla entries which do not contain upstream references. Could you plese invstigate the individual issues? CVE-2026-71219[0]: | A stack overflow vulnerability was found in gfs2-utils. The hash | table traversal code in metawalk.c uses alloca() with an | exponentially-derived size from the untrusted on-disk di_depth field | without bounds validation. A crafted GFS2 filesystem image with a | large di_depth value causes stack exhaustion and a denial of service | when processed by fsck.gfs2, gfs2_edit, or savemeta. CVE-2026-71220[1]: | A stack out-of-bounds write vulnerability was found in gfs2-utils. | In gfs2_edit, the di_height field from on-disk inode metadata is | used as an array index without bounds checking, causing a stack | buffer overflow that may lead to arbitrary code execution when | processing crafted GFS2 filesystem images. CVE-2026-71221[2]: | A stack out-of-bounds write vulnerability was found in gfs2-utils. | In savemeta, the height value from on-disk inode metadata is used as | a loop bound without bounds checking, causing a stack buffer | overflow that may lead to arbitrary code execution when processing | crafted GFS2 filesystem images. CVE-2026-71222[3]: | A heap out-of-bounds read vulnerability was found in gfs2-utils. The | ea_num_ptrs field from on-disk extended attribute metadata is | consumed without bounds validation, causing a heap buffer over-read | that may disclose sensitive memory contents or cause a crash when | processing crafted GFS2 filesystem images. CVE-2026-71223[4]: | gfs2-utils: integer overflow in resource group allocation size on 32- | bit platforms CVE-2026-71224[5]: | A stack overflow vulnerability was found in gfs2-utils. The metadata | walk code in metawalk.c uses alloca() with an untrusted inode height | value from on-disk metadata without bounds validation, causing stack | exhaustion and a denial of service when processing crafted GFS2 | filesystem images. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-71219 https://www.cve.org/CVERecord?id=CVE-2026-71219 [1] https://security-tracker.debian.org/tracker/CVE-2026-71220 https://www.cve.org/CVERecord?id=CVE-2026-71220 [2] https://security-tracker.debian.org/tracker/CVE-2026-71221 https://www.cve.org/CVERecord?id=CVE-2026-71221 [3] https://security-tracker.debian.org/tracker/CVE-2026-71222 https://www.cve.org/CVERecord?id=CVE-2026-71222 [4] https://security-tracker.debian.org/tracker/CVE-2026-71223 https://www.cve.org/CVERecord?id=CVE-2026-71223 [5] https://security-tracker.debian.org/tracker/CVE-2026-71224 https://www.cve.org/CVERecord?id=CVE-2026-71224 Regards, Salvatore ]