Directory Traversal Vulnerability in Zephyr's ext2 Directory-Entry Parser

CVE-2026-10645

What is CVE-2026-10645?

The ext2 directory-entry parser in Zephyr fails to properly validate the structure of on-disk directory entries, potentially leading to unvalidated memory copies. This vulnerability is triggered during directory traversal operations, such as pathname lookups or file manipulations, and can result in denial of service incidents or out-of-bounds reads. Attackers can exploit this issue by mounting specially crafted ext2 images from untrusted media, causing either excessive resource consumption or corrupting memory with invalid data.

References