AZL-99906

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99906.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-99906

Upstream

CVE-2026-71219

Published

2026-09-03T13:06:02Z

Modified

2026-09-13T06:06:36Z

Summary

CVE-2026-71219 affecting package gfs2-utils 3.5.1-1

Details

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-71219

Affected packages

Azure Linux:3 / gfs2-utils

Package

Name: gfs2-utils
Purl: pkg:rpm/azure-linux/gfs2-utils

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.5.1-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99906.json"