CVE-2026-34962
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A denial-of-service vulnerability in barebox prior to version 2026.04.0 allows attackers to cause an infinite loop during directory listing or path resolution by supplying a malicious ext4 filesystem image with a crafted directory entry containing a zero-length value.
Risk Assessment
An attacker can provide a malicious ext4 image that hangs the boot process, preventing normal device operation.
Recommendation
Update barebox to version 2026.04.0 or later, which includes a fix for validating directory entry length values.
Original NVD description (English source)
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.