The vulnerability in Zephyr's ext2 directory-entry parser arises because ext2_fetch_direntry() only checks that the directory entry name length is within a maximum limit but does not validate the relationship between the directory entry record length, name length, and the directory block boundary. This lack of validation allows a crafted ext2 image to cause an out-of-bounds read or an infinite loop during directory traversal operations. The issue manifests after mounting, during filesystem operations that traverse directories, and can lead to denial of service or information leakage from out-of-bounds memory reads.

An attacker controlling an ext2 image mounted on Zephyr can cause denial of service by triggering infinite loops or out-of-bounds reads during directory traversal. The out-of-bounds read may lead to limited information disclosure. There is no indication of code execution or privilege escalation. The vulnerability requires local access to mount or access the crafted ext2 image.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid mounting untrusted ext2 images on affected Zephyr versions. Monitor vendor communications for patches or updates addressing this issue.