Denial-of-Service Vulnerability in barebox Affecting ext4 File System Parsing

CVE-2026-34962

What is CVE-2026-34962?

A denial-of-service vulnerability exists in barebox prior to version 2026.04.0, affecting its handling of ext4 directory parsing. The flaw occurs in the ext4fs_iterate_dir() function located within fs/ext4/ext4_common.c, where insufficient validation of directory entry length values allows attackers to exploit the system. By supplying a crafted ext4 filesystem image with a directory entry containing a zero length (direntlen value of 0), an attacker can induce an infinite loop during directory listing or path resolution. This failure can lead to the boot process hanging indefinitely, posing serious risks to system availability.

References