The vulnerability is a stack overflow caused by the use of alloca() without bounds validation during hash table traversal in metawalk.c of gfs2-utils. A specially crafted GFS2 filesystem image with an excessively large di_depth field can exhaust the stack when processed by fsck.gfs2, gfs2_edit, or savemeta, leading to a denial of service. This weakness originates from improper input validation (CWE-770) and affects the ability of authenticated users to manipulate filesystem images that are later scanned or modified by system tools.

The flaw exists in all Red Hat Enterprise Linux releases that ship the gfs2-utils package: RHEL 7, RHEL 8, and RHEL 9. All installed instances of gfs2-utils on these distributions that have not been patched are vulnerable. No specific version numbers are listed, so the entire distribution family is considered affected.

The CVSS score of 4.7 classifies the issue as moderate severity. No EPSS score is available, so the current likelihood of exploitation is unclear. The vulnerability is not listed in CISA KEV. An attacker can exploit it by creating or presenting a malicious GFS2 image and having it processed by an administrative or automated fsck process; the exploit requires local access to the image or the ability to trigger fsck on the host. Successful exploitation results in a local denial of service that could interrupt system operations, while disruption of critical services could have moderate operational impact.