A stack overflow can be triggered in the gfs2-utils package when its metadata walk routine in metawalk.c uses alloca() with an untrusted inode height value read directly from disk. The lack of bounds validation allows a crafted GFS2 filesystem image to exhaust the process stack, leading to a denial of service by crashing the tool. This issue is categorized as a stack-based buffer overflow (CWE‑770).

The vulnerability is present in the gfs2-utils components shipped with Red Hat Enterprise Linux 7, 8, and 9. All installations that use the gfs2 file system and run gfs2‑utils tools are potentially affected; no specific sub‑version information is provided.

The CVSS base score of 4.7 indicates a low severity. Since the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, there is no current evidence of active exploitation. The attack likely requires an attacker to deliver a malicious GFS2 image to the system and invoke a gfs2‑utils operation, which is normally a local process. The output of the exploit would be a crash of the utility, resulting in a denial of service to that operation but not to the entire system.