CVE-2026-124742: Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value

Published Nov 11, 2026

Updated

A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.

Other sources

A flaw was found in BusyBox's volumeid FAT prober. A magic string in the boot sector, such as "FAT16 ", skips the geometry checks, so a sectorspercluster value of 0 can be used as a divisor, causing a divide-by-zero (SIGFPE) crash. A crafted filesystem image on an attached device triggers this when probed by blkid, findfs or mount LABEL=/UUID=, which probe every device in /proc/partitions; the crash prevents those applets from resolving any device and may fail boot or hotplug scripts that rely on them.

— Red Hat

Affected Software

0 affected components

Event History

Nov 11, 2026

Data Sourced

via Red Hat·09:49 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·11:19 AM

Data Sourced

via MITRE·11:19 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are realistically exposed to this denial of service?

Systems using BusyBox blkid, findfs, or mount with LABEL= or UUID= resolution are exposed when those applets probe devices listed in /proc/partitions. The impact is most significant where boot or hotplug scripts depend on these utilities for device discovery.

What does an attacker need to trigger the crash?

An attacker needs to present a crafted storage device or disk image containing a specially formatted FAT filesystem. The filesystem boot sector can use a FAT magic string that bypasses geometry checks and set sectors_per_cluster to zero.

Is direct execution of a probing utility required for exploitation?

A vulnerable probing path must inspect the crafted device. blkid, findfs, and mount operations using LABEL= or UUID= can probe every device in /proc/partitions, so scanning a device can trigger the crash even when the target device is not the one being resolved.

How can operators recognize that this issue is affecting a system?

Affected systems may show a SIGFPE or divide-by-zero crash in BusyBox volume identification while probing a device. Device resolution can fail broadly, including failure to resolve any device through the affected applets, and boot or hotplug scripts may fail as a result.

CVE-2026-124742: Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value

Other sources

Affected Software

Event History

Frequently Asked Questions

Which systems are realistically exposed to this denial of service?

What does an attacker need to trigger the crash?

Is direct execution of a probing utility required for exploitation?

How can operators recognize that this issue is affecting a system?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed to this denial of service?

What does an attacker need to trigger the crash?

Is direct execution of a probing utility required for exploitation?

How can operators recognize that this issue is affecting a system?