CVE-2026-13478
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Zephyr ext2 filesystem driver contains an out-of-bounds read vulnerability triggered when mounting a crafted ext2 image. The ext2_bitmap_count_set() function scans memory based on unvalidated superblock values, potentially reading about 512 MB past the bitmap buffer.
Risk Assessment
An attacker can cause a system crash (denial of service) by mounting a malicious ext2 image from removable media, a disk partition, or a downloaded file. The vulnerability does not allow data leakage but may lead to device hang or reboot.
Recommendation
Apply the fix that rejects ext2 images where the block count exceeds the bitmap capacity (fs->block_size * 8). Update to a patched version or patch the source code before mounting untrusted ext2 images.
Other vulnerabilities in Zephyr ext2 filesystem driver
See all- CVE-2026-13215Medium
The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. A crafted image can cause a shift overflow or oversized block size, leading to an out-of-bounds write into static memory in kernel mode.
- CVE-2026-10645Medium
The Zephyr ext2 filesystem driver trusts on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. The validation of de_name_len is ineffective, allowing up to 263 bytes out-of-bounds read past the block buffer, leading to kernel memory leak, and a de_rec_len of 0 causes an infinite loop (denial of service). Affected versions from v3.5.0 to v4.4.0.
Original NVD description (English source)
The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_block to ext2_bitmap_count_set(). That helper (subsys/fs/ext2/ext2_bitmap.c) treats its argument as a number of bits and reads one bitmap byte per eight bits, but the bitmap buffer (BGROUP_BLOCK_BITMAP) is a single fetched block of only fs->block_size bytes (capacity fs->block_size * 8 bits). s_blocks_count and s_first_data_block are taken verbatim from the superblock and were never bounded against this single-group capacity; ext2_verify_disk_superblock() checks the magic, revision, and block-size shift but not the block count. A crafted ext2 image with an oversized s_blocks_count (up to ~4 billion, against a maximum 4096-byte block / 32768-bit bitmap) makes ext2_bitmap_count_set() scan roughly 512 MB of memory past the bitmap block — a large out-of-bounds read of the static block slab and adjacent memory. The defect is reached during mount: ext2_init_fs() is invoked from ext2_mount() (subsys/fs/ext2/ext2_ops.c), the registered .mount operation. Any path that mounts an attacker-supplied ext2 image (removable media, a disk/flash partition, or a downloaded image) triggers it. The kernel-privileged parser operates on attacker-controlled data, so the bug is exploitable wherever untrusted ext2 media can be mounted. Impact is an out-of-bounds read only: the resulting bit count is compared internally and the mount is rejected, so no attacker-controlled bytes are returned (not a useful information leak). The ~512 MB over-read will almost certainly cross an unmapped or MPU-protected boundary and fault, crashing the system — a denial of service triggered by mounting a single malformed image. The fix rejects any image whose fs_blocks exceeds fs->block_size * 8 before the scan.