UBUNTU-CVE-2026-124742: Medium severity ubuntu/busybox vulnerability
A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Ubuntu's BusyBox utilities are exposed when they inspect FAT filesystems from untrusted or removable storage devices, or from attacker-controlled disk images. The impact is a crash of the volume-probing utilities, which can disrupt device discovery or boot operations.
What must an attacker provide to trigger the crash?
An attacker must be able to present a specially crafted FAT filesystem through a storage device or disk image and have BusyBox partition-scanning utilities inspect it. The crafted filesystem contains cluster parameters that cause a divide-by-zero condition during volume identification.