CVE-2026-71222: Red Hat Enterprise Linux

Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days.

A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.

Affected products

• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only

Published 2026-09-03. Last modified 2026-09-22.