The Zephyr ext2 filesystem driver trusted on-disk directory entry fields de_rec_len and de_name_len without proper validation. The check on de_name_len was ineffective because it is a uint8_t and compared against 255, making the condition always false. This allowed memcpy operations to read up to 255 bytes and directory traversal to advance by an unvalidated de_rec_len, potentially reading or writing beyond the block buffer into adjacent heap memory. This leads to information leakage of kernel heap memory and denial of service via infinite loops caused by zero de_rec_len. The vulnerability is triggered by any filesystem operation on a mounted ext2 volume with crafted or corrupted images. The affected versions are Zephyr ext2 from v3.5.0 through v4.4.0. The fix validates rec_len and name_len, rejecting entries that do not fit within the block boundaries.

An attacker supplying a crafted or corrupted ext2 filesystem image on removable or mounted storage can cause out-of-bounds reads and writes in kernel memory, leading to leakage of adjacent kernel heap memory. Additionally, a zero de_rec_len value can cause an infinite loop, resulting in denial of service. The vulnerability affects all path-based operations and directory listings on the mounted ext2 volume.

A fix is available that validates the rec_len and name_len fields in directory entries and rejects malformed entries that do not fit within the block boundaries. Users should update to a fixed version of the Zephyr ext2 filesystem driver beyond v4.4.0. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.