ZephyrProject Zephyr up to 4.4.x ext2 ext2_impl.c ext2_verify_disk_superblock s_blocks_per_group/s_inodes_per_group divide by zero

Summaryinfo

A vulnerability marked as critical has been reported in ZephyrProject Zephyr up to 4.4.x. This issue affects the function ext2_verify_disk_superblock of the file subsys/fs/ext2/ext2_impl.c of the component ext2. The manipulation of the argument s_blocks_per_group/s_inodes_per_group leads to divide by zero. This vulnerability is referenced as CVE-2026-7007. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ZephyrProject Zephyr up to 4.4.x. This issue affects the function ext2_verify_disk_superblock of the file subsys/fs/ext2/ext2_impl.c of the component ext2. The manipulation of the argument s_blocks_per_group/s_inodes_per_group with an unknown input leads to a divide by zero vulnerability. Using CWE to declare the problem leads to CWE-369. The product divides a value by zero. Impacted is availability. The summary by CVE is:

The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor. The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-7007 since 04/25/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch babc0900ed40e6c023ccc26aa1a321f9388b66af is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion