CVE-2026-7007 in Zephyr
Summary
by MITRE • 07/24/2026
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.
During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.
An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.
The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides within the Zephyr operating system's ext2 file system implementation where insufficient validation of on-disk superblock parameters creates a potential for denial of service attacks. The ext2_verify_disk_superblock() function in subsys/fs/ext2/ext2_impl.c performs essential checks including magic number verification, block size validation, revision consistency, and feature flag assessment but fails to validate critical fields s_blocks_per_group and s_inodes_per_group. These fields, when read directly from the file system image, serve as divisors during mount-time initialization processes without proper zero-checking mechanisms.
The technical flaw manifests through integer division by zero conditions that occur during normal mount sequence operations. The get_ngroups() function in ext2_diskops.c performs division operations using s_blocks_count divided by s_blocks_per_group, while get_itable_entry() utilizes s_inodes_per_group as a divisor when accessing root inode information. When either of these fields contains a zero value, the division operations immediately trigger arithmetic exceptions that propagate through the system's exception handling mechanisms. This particular vulnerability affects ARMv7-M and ARMv8-M-mainline Cortex-M targets where the SCB_CCR_DIV_0_TRP bit is enabled, causing divide-by-zero conditions to generate UsageFault exceptions.
The operational impact of this vulnerability is limited to availability disruption rather than data compromise or privilege escalation. An attacker capable of presenting a crafted ext2 image to a device that mounts ext2 file systems can trigger the denial of service condition through removable media such as SD cards or USB mass-storage devices. The system responds to the fault by treating it as a fatal error, resulting in complete mount failure and system unavailability for file system operations. This represents a classic denial of service scenario where legitimate system functionality is disrupted without compromising security boundaries.
The mitigation strategy involves implementing mandatory validation checks within the ext2_verify_disk_superblock() function to explicitly reject superblocks containing zero values in s_blocks_per_group or s_inodes_per_group fields. The fix returns -EINVAL error codes during early validation stages, ensuring that mount operations fail gracefully before any block-group or inode I/O processing occurs. This approach aligns with established security practices for preventing arithmetic exceptions and follows the principle of input validation commonly referenced in CWE-369 and CWE-128 vulnerability categories. The solution prevents the problematic division operations from occurring while maintaining system stability through early failure detection mechanisms that are consistent with ATT&CK technique T1499.004 for availability disruption prevention.