Denial of Service Vulnerability in Zephyr's ext2 File System
CVE-2026-7007

4.6MEDIUM

Key Information:

Vendor

Zephyrproject

Status
Zephyr
Vendor
CVE Published:
24 July 2026

What is CVE-2026-7007?

The ext2 file system in Zephyr RTOS contains a vulnerability where the superblock validation does not adequately check that the fields s_blocks_per_group and s_inodes_per_group are non-zero. This oversight can lead to integer division by zero, potentially causing a denial of service if an attacker presents a crafted ext2 image on devices that mount ext2 file systems. When these zero fields are encountered during the mount process, the system experiences a fatal error due to division by zero trapping. The fix ensures that any superblock with these fields set to zero is rejected before any processing occurs.

Affected Version(s)

zephyr 3.5.0 < 4.5.0

References

https://github.com/zephyrproject-rtos/zephyr/commit/babc0...
patch
https://github.com/zephyrproject-rtos/zephyr/security/adv...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.