Red Hat Enterprise Linux 7/8/9 Hash Table Traversal metawalk.c alloca di_depth stack-based overflow

Summaryinfo

A vulnerability classified as problematic has been found in Red Hat Enterprise Linux 7/8/9. This affects the function alloca of the file metawalk.c of the component Hash Table Traversal. The manipulation of the argument di_depth leads to stack-based overflow. This vulnerability is documented as CVE-2026-71219. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in Red Hat Enterprise Linux 7/8/9. It has been rated as problematic. This issue affects the function alloca of the file metawalk.c of the component Hash Table Traversal. The manipulation of the argument di_depth with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. The summary by CVE is:

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.

It is possible to read the advisory at access.redhat.com. The identification of this vulnerability is CVE-2026-71219 since 08/05/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/03/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux

Version

• 7
• 8
• 9

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion