Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4004
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
FAQs regarding Amazon Linux ALAS/CVE Severity
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta. (CVE-2026-71219)
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images. (CVE-2026-71220)
A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images. (CVE-2026-71221)
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images. (CVE-2026-71222)
Affected Packages:
gfs2-utils
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update gfs2-utils or yum update --advisory ALAS2-2026-4004 to update your system.
src:
gfs2-utils-3.1.10-6.amzn2.0.1.src
x86_64:
gfs2-utils-3.1.10-6.amzn2.0.1.x86_64
gfs2-utils-debuginfo-3.1.10-6.amzn2.0.1.x86_64