CVE-2026-7007: Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image
The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock() (subsys/fs/ext2/ext2impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and sinodespergroup are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.
During mount, getngroups() divides and modulos sblockscount by sblockspergroup (reached via ext2fetchblockgroup() from ext2initfs()), and getitableentry() divides (ino - 1) by sinodespergroup when fetching the root inode (both in subsys/fs/ext2/ext2diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.
An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCBCCRDIV0TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.
The fix rejects a zero sblockspergroup or sinodespergroup in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Devices are exposed when they mount ext2 filesystem images supplied through attacker-influenced media, such as SD cards or USB mass-storage devices. Exploitation does not require privileges or user interaction according to the supplied vector.
What is required to trigger the denial of service?
An attacker needs to provide an ext2 image whose superblock sets either s_blocks_per_group or s_inodes_per_group to zero and have the target mount that image. The fault is reached during mount-time initialization.
What is the observed impact on affected Cortex-M targets?
On ARMv7-M and ARMv8-M-mainline Cortex-M targets with divide-by-zero trapping enabled, the invalid division raises a UsageFault that Zephyr treats as fatal, causing denial of service. The provided data does not establish the runtime outcome on other architectures.
How can I determine whether an ext2 image would trigger the issue?
The issue is relevant if the device mounts an ext2 image and the image's on-disk superblock contains zero for s_blocks_per_group or s_inodes_per_group. Those fields are consumed as divisors during the mount sequence.