This vulnerability involves a NULL pointer dereference in the ext4_dir_en_get_name_len function within include/ext4_dir.h of lwext4 1.0.0. When iterating over directory entries in an EXT4 filesystem image, if the directory entry pointer is malformed and not validated, accessing the name_len field causes a segmentation fault. This can be triggered by supplying a crafted EXT4 filesystem image with malformed directory entries, resulting in a denial of service condition. The affected codebase corresponds to the 2016-era lwext4 1.0.0 version or equivalent. No CVSS score or remediation details are currently available.

Successful exploitation causes a denial of service by crashing the process handling the EXT4 filesystem image due to a segmentation fault triggered by a NULL pointer dereference. There is no indication of code execution or data corruption beyond service disruption. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or malformed EXT4 filesystem images with affected versions of lwext4. Monitor vendor channels for updates regarding patches or workarounds.