CVE-2026-7007: dos in zephyrproject zephyr
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor. The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
AI Analysis
Technical Summary
The Zephyr ext2 file system's on-disk superblock validation function ext2_verify_disk_superblock() does not verify that the s_blocks_per_group and s_inodes_per_group fields are non-zero. These fields are used as divisors during mount-time initialization in functions get_ngroups() and get_itable_entry(). If either field is zero, an integer division by zero occurs during mount, which on ARM Cortex-M targets with divide-by-zero trapping enabled causes a UsageFault. Zephyr treats this fault as fatal, resulting in a denial of service. The vulnerability can be triggered by presenting a crafted ext2 image (e.g., on removable media) to a device that mounts ext2. The fix rejects zero values in these fields during superblock validation, causing the mount to fail early without performing block-group or inode I/O.
Potential Impact
An attacker able to provide a crafted ext2 image can cause a denial of service on devices running affected Zephyr versions by triggering a division by zero during mount. This results in a fatal UsageFault on ARM Cortex-M targets with divide-by-zero trapping enabled, causing the mount operation to fail and denying availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects zero values for s_blocks_per_group and s_inodes_per_group during superblock validation, causing the mount to fail safely. Until a patch is applied, avoid mounting untrusted ext2 images, especially from removable media. Monitor vendor advisories for an official fix.
CVE-2026-7007: dos in zephyrproject zephyr
Description
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor. The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
CVSS v3.1
Score 4.6medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Zephyr ext2 file system's on-disk superblock validation function ext2_verify_disk_superblock() does not verify that the s_blocks_per_group and s_inodes_per_group fields are non-zero. These fields are used as divisors during mount-time initialization in functions get_ngroups() and get_itable_entry(). If either field is zero, an integer division by zero occurs during mount, which on ARM Cortex-M targets with divide-by-zero trapping enabled causes a UsageFault. Zephyr treats this fault as fatal, resulting in a denial of service. The vulnerability can be triggered by presenting a crafted ext2 image (e.g., on removable media) to a device that mounts ext2. The fix rejects zero values in these fields during superblock validation, causing the mount to fail early without performing block-group or inode I/O.
Potential Impact
An attacker able to provide a crafted ext2 image can cause a denial of service on devices running affected Zephyr versions by triggering a division by zero during mount. This results in a fatal UsageFault on ARM Cortex-M targets with divide-by-zero trapping enabled, causing the mount operation to fail and denying availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects zero values for s_blocks_per_group and s_inodes_per_group during superblock validation, causing the mount to fail safely. Until a patch is applied, avoid mounting untrusted ext2 images, especially from removable media. Monitor vendor advisories for an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-04-24T22:00:52.689Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6378c69c2644c7f8151ed4
Added to database: 07/24/2026, 14:37:58 UTC
Last enriched: 07/24/2026, 14:53:09 UTC
Last updated: 07/25/2026, 02:03:56 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.