CVE-2026-13215: bounds in zephyrproject zephyr

The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field in the on-disk superblock during mount. The function ext2_verify_disk_superblock() checks several fields but does not bound s_log_block_size. The driver calculates fs->block_size = 1024 << s_log_block_size, which can overflow or produce a block size larger than CONFIG_EXT2_MAX_BLOCK_SIZE. This block size is used to initialize memory slabs via k_mem_slab_init() without verifying that the requested size fits the backing buffer. Consequently, the slab memory layout can overflow the static buffer, causing out-of-bounds writes when reading filesystem blocks. Because the ext2 driver operates in kernel mode, this memory corruption can be exploited by any attacker able to present a crafted ext2 image to a device that mounts it (e.g., removable storage). The fix involves rejecting s_log_block_size values that cause overflow or exceed the maximum allowed block size, preventing slab initialization beyond the buffer size.

An attacker who can supply a crafted ext2 filesystem image to a device running the vulnerable Zephyr ext2 driver can trigger out-of-bounds writes in kernel memory. This memory corruption occurs during filesystem mount and can lead to denial of service or potentially arbitrary code execution with kernel privileges. The vulnerability is exploitable without privileges and requires only presenting a malicious filesystem image to the system.

A fix is available that rejects s_log_block_size values greater than 11 or that produce a block size exceeding CONFIG_EXT2_MAX_BLOCK_SIZE. This prevents initializing memory slabs larger than their backing buffer and eliminates the out-of-bounds write. Users should upgrade to Zephyr version 4.4.2 or later where this issue is fixed. Until then, avoid mounting untrusted ext2 filesystem images.