CVE-2026-7007: Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

Q: Which deployments are realistically exposed?

Devices are exposed when they mount ext2 filesystem images supplied through attacker-influenced media, such as SD cards or USB mass-storage devices. Exploitation does not require privileges or user interaction according to the supplied vector.

Q: What is required to trigger the denial of service?

An attacker needs to provide an ext2 image whose superblock sets either s_blocks_per_group or s_inodes_per_group to zero and have the target mount that image. The fault is reached during mount-time initialization.

Q: What is the observed impact on affected Cortex-M targets?

On ARMv7-M and ARMv8-M-mainline Cortex-M targets with divide-by-zero trapping enabled, the invalid division raises a UsageFault that Zephyr treats as fatal, causing denial of service. The provided data does not establish the runtime outcome on other architectures.

Q: How can I determine whether an ext2 image would trigger the issue?

The issue is relevant if the device mounts an ext2 image and the image's on-disk superblock contains zero for s_blocks_per_group or s_inodes_per_group. Those fields are consumed as divisors during the mount sequence.

Published Jul 24, 2026

Updated

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock() (subsys/fs/ext2/ext2impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and sinodespergroup are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.

During mount, getngroups() divides and modulos sblockscount by sblockspergroup (reached via ext2fetchblockgroup() from ext2initfs()), and getitableentry() divides (ino - 1) by sinodespergroup when fetching the root inode (both in subsys/fs/ext2/ext2diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.

An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCBCCRDIV0TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.

The fix rejects a zero sblockspergroup or sinodespergroup in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.

Affected Software

3 affected components

Zephyr

ext2

zephyrproject zephyr>=3.5.0<4.5.0

Event History

Jul 24, 2026

CVE Published

via MITRE·01:48 PM

Data Sourced

via MITRE·01:48 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:19 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are realistically exposed?

Devices are exposed when they mount ext2 filesystem images supplied through attacker-influenced media, such as SD cards or USB mass-storage devices. Exploitation does not require privileges or user interaction according to the supplied vector.

What is required to trigger the denial of service?

An attacker needs to provide an ext2 image whose superblock sets either s_blocks_per_group or s_inodes_per_group to zero and have the target mount that image. The fault is reached during mount-time initialization.

What is the observed impact on affected Cortex-M targets?

On ARMv7-M and ARMv8-M-mainline Cortex-M targets with divide-by-zero trapping enabled, the invalid division raises a UsageFault that Zephyr treats as fatal, causing denial of service. The provided data does not establish the runtime outcome on other architectures.

How can I determine whether an ext2 image would trigger the issue?

The issue is relevant if the device mounts an ext2 image and the image's on-disk superblock contains zero for s_blocks_per_group or s_inodes_per_group. Those fields are consumed as divisors during the mount sequence.

CVE-2026-7007: Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What is required to trigger the denial of service?

What is the observed impact on affected Cortex-M targets?

How can I determine whether an ext2 image would trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What is required to trigger the denial of service?

What is the observed impact on affected Cortex-M targets?

How can I determine whether an ext2 image would trigger the issue?