CVE-2026-34961: barebox ext4 Extent Parsing Out-of-Bounds Read
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the ehentries field against buffer capacity in fs/ext4/ext4common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
barebox ext4to a version that resolves this vulnerability.Fixed in 2026.04.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34961?
CVE-2026-34961 is classified as a medium severity vulnerability due to potential out-of-bounds read attacks that can be exploited remotely.
How do I fix CVE-2026-34961?
To fix CVE-2026-34961, upgrade Barebox to version 2026.04.0 or later, which addresses the out-of-bounds read vulnerabilities.
What type of attack can CVE-2026-34961 facilitate?
CVE-2026-34961 can facilitate attacks through the exploitation of malicious ext4 filesystem images supplied via USB, SD card, or network boot.
Which versions of Barebox are affected by CVE-2026-34961?
Barebox versions prior to 2026.04.0 are affected by CVE-2026-34961 due to the out-of-bounds read vulnerabilities.
What components of Barebox are impacted by CVE-2026-34961?
CVE-2026-34961 impacts the ext4 extent parsing component in the Barebox filesystem implementation.