CVE-2026-34962: barebox ext4 Directory Parsing Infinite Loop Denial of Service
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4common.c where the ext4fsiteratedir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
barebox ext4 (fs/ext4/ext4_common.c / ext4fs_iterate_dir)to a version that resolves this vulnerability.Fixed in 2026.04.0 - Compensating control
If you cannot immediately upgrade barebox, avoid booting from untrusted media/images because the vulnerability can be triggered by a crafted ext4 filesystem image that causes an infinite loop during directory listing or path resolution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34962?
CVE-2026-34962 is a denial-of-service vulnerability that can cause an infinite loop in the ext4 directory parsing.
How do I fix CVE-2026-34962?
To fix CVE-2026-34962, upgrade to barebox version 2026.04.0 or later.
Which versions of barebox are affected by CVE-2026-34962?
CVE-2026-34962 affects barebox versions prior to 2026.04.0.
What component of barebox does CVE-2026-34962 affect?
CVE-2026-34962 affects the ext4 directory parsing functionality in the barebox filesystem.
What kind of attack vector does CVE-2026-34962 represent?
CVE-2026-34962 represents a remote denial-of-service attack vector through ext4 directory parsing.