Out-of-bounds Read in Zephyr's ext2 Filesystem Driver Affects Linux Kernel Systems

CVE-2026-13478

What is CVE-2026-13478?

The ext2 filesystem driver in Zephyr is vulnerable to an out-of-bounds read due to improper validation of on-disk block bitmap sizes. When an attacker supplies a crafted ext2 image with an oversized block count, it can cause the driver to read memory beyond the allocated bitmap buffer, potentially leading to a system crash. This vulnerability can be triggered whenever untrusted ext2 media is mounted, creating a risk of Denial of Service for affected Linux kernel systems. To mitigate this issue, a fix has been implemented to reject images with excessive block counts before processing.

References