CVE-2026-7007: dos in zephyrproject zephyr
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor. The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
AI Analysis
Technical Summary
The Zephyr ext2 file system's on-disk superblock validation in ext2_verify_disk_superblock() does not verify that s_blocks_per_group and s_inodes_per_group are non-zero. These fields are used as divisors in mount-time calculations (get_ngroups() and get_itable_entry()). If either field is zero, an integer division by zero occurs during mounting. On ARMv7-M and ARMv8-M Cortex-M devices with divide-by-zero trapping enabled, this causes a UsageFault that Zephyr treats as fatal, leading to denial of service. The vulnerability can be triggered by presenting a crafted ext2 image, such as from removable media. The fix involves rejecting superblocks with zero values in these fields, causing the mount to fail early.
Potential Impact
The vulnerability causes a denial of service by triggering a fatal UsageFault due to division by zero during the mounting of a crafted ext2 file system image. There is no impact on confidentiality or integrity, only availability is affected. The issue is specific to ARM Cortex-M targets with divide-by-zero trapping enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects zero values in s_blocks_per_group and s_inodes_per_group during superblock validation, preventing the mount from proceeding. Until an official fix is confirmed, avoid mounting untrusted ext2 images on affected Zephyr devices, especially on ARM Cortex-M platforms with divide-by-zero trapping enabled.
CVE-2026-7007: dos in zephyrproject zephyr
Description
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor. The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
CVSS v3.1
Score 4.6medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Zephyr ext2 file system's on-disk superblock validation in ext2_verify_disk_superblock() does not verify that s_blocks_per_group and s_inodes_per_group are non-zero. These fields are used as divisors in mount-time calculations (get_ngroups() and get_itable_entry()). If either field is zero, an integer division by zero occurs during mounting. On ARMv7-M and ARMv8-M Cortex-M devices with divide-by-zero trapping enabled, this causes a UsageFault that Zephyr treats as fatal, leading to denial of service. The vulnerability can be triggered by presenting a crafted ext2 image, such as from removable media. The fix involves rejecting superblocks with zero values in these fields, causing the mount to fail early.
Potential Impact
The vulnerability causes a denial of service by triggering a fatal UsageFault due to division by zero during the mounting of a crafted ext2 file system image. There is no impact on confidentiality or integrity, only availability is affected. The issue is specific to ARM Cortex-M targets with divide-by-zero trapping enabled.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects zero values in s_blocks_per_group and s_inodes_per_group during superblock validation, preventing the mount from proceeding. Until an official fix is confirmed, avoid mounting untrusted ext2 images on affected Zephyr devices, especially on ARM Cortex-M platforms with divide-by-zero trapping enabled.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-04-24T22:00:52.689Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6378c69c2644c7f8151ed4
Added to database: 07/24/2026, 14:37:58 UTC
Last enriched: 07/31/2026, 15:22:45 UTC
Last updated: 09/07/2026, 11:04:12 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.