REDHAT-BUG-2571620: Medium severity vulnerability

Published Nov 11, 2026

Updated

A flaw was found in BusyBox's volumeid FAT prober. A magic string in the boot sector, such as "FAT16 ", skips the geometry checks, so a sectorspercluster value of 0 can be used as a divisor, causing a divide-by-zero (SIGFPE) crash. A crafted filesystem image on an attached device triggers this when probed by blkid, findfs or mount LABEL=/UUID=, which probe every device in /proc/partitions; the crash prevents those applets from resolving any device and may fail boot or hotplug scripts that rely on them.

Affected Software

0 affected components

Event History

Nov 11, 2026

Data Sourced

via Red Hat·09:49 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What systems are realistically exposed to this issue?

Systems using BusyBox utilities that invoke the affected volume_id FAT probe are exposed when they probe attached block devices. The described impact is most relevant to boot or hotplug workflows that rely on blkid, findfs, or mount using LABEL= or UUID= resolution.

What does an attacker need to trigger the crash?

An attacker needs to provide or make available a crafted FAT filesystem image on an attached device. The image must contain a boot-sector magic string such as "FAT16 " and a sectors_per_cluster value of 0, then be probed by the affected utilities.

Is ordinary device probing enough to trigger it?

Yes. blkid, findfs, and mount LABEL=/UUID= probe every device listed in /proc/partitions, so the crafted device can cause a crash when those utilities perform their normal probing.

How can I tell whether the issue is affecting a system?

A likely indicator is blkid, findfs, or mount LABEL=/UUID= terminating with a SIGFPE crash while a crafted or suspect attached filesystem is present. Resulting failures to resolve devices may also disrupt dependent boot or hotplug scripts.

REDHAT-BUG-2571620: Medium severity vulnerability

Affected Software

Event History

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to trigger the crash?

Is ordinary device probing enough to trigger it?

How can I tell whether the issue is affecting a system?

Company

Resources

Contact

Frequently Asked Questions

What systems are realistically exposed to this issue?

What does an attacker need to trigger the crash?

Is ordinary device probing enough to trigger it?

How can I tell whether the issue is affecting a system?