CVE-2026-7007: Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

Published Jul 24, 2026
·
Updated

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock() (subsys/fs/ext2/ext2impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and sinodespergroup are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.

During mount, getngroups() divides and modulos sblockscount by sblockspergroup (reached via ext2fetchblockgroup() from ext2initfs()), and getitableentry() divides (ino - 1) by sinodespergroup when fetching the root inode (both in subsys/fs/ext2/ext2diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.

An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCBCCRDIV0TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.

The fix rejects a zero sblockspergroup or sinodespergroup in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.

Affected Software

3 affected components
Zephyr
ext2
zephyrproject zephyr>=3.5.0<4.5.0

Event History

Jul 24, 2026
CVE Published
via MITRE·01:48 PM
Data Sourced
via MITRE·01:48 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:19 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which deployments are realistically exposed?

Devices are exposed when they mount ext2 filesystem images supplied through attacker-influenced media, such as SD cards or USB mass-storage devices. Exploitation does not require privileges or user interaction according to the supplied vector.

2

What is required to trigger the denial of service?

An attacker needs to provide an ext2 image whose superblock sets either s_blocks_per_group or s_inodes_per_group to zero and have the target mount that image. The fault is reached during mount-time initialization.

3

What is the observed impact on affected Cortex-M targets?

On ARMv7-M and ARMv8-M-mainline Cortex-M targets with divide-by-zero trapping enabled, the invalid division raises a UsageFault that Zephyr treats as fatal, causing denial of service. The provided data does not establish the runtime outcome on other architectures.

4

How can I determine whether an ext2 image would trigger the issue?

The issue is relevant if the device mounts an ext2 image and the image's on-disk superblock contains zero for s_blocks_per_group or s_inodes_per_group. Those fields are consumed as divisors during the mount sequence.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203