CVE-2026-10645

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The ext2 directory-entry parser fails to fully validate the on-disk directory entry structure before copying the entry name and advancing the traversal state. Specifically, in the ext2 fetch direntry() function, the system checks if de name len is less than or equal to EXT2 MAX FILE NAME but does not validate the structural relationship between de rec len, de name len, and the directory block boundary. This includes failing to verify that de rec len is non-zero, at least the size of the entry header, and that the record fits within the block. Functions such as find dir entry() and ext2 get direntry() then use the unvalidated de rec len to advance traversal. A crafted ext2 image can trigger an out-of-bounds read from the directory block buffer via an oversized name copy or cause an infinite loop if de rec len is zero. This issue occurs during directory traversal paths, including pathname lookup, stat, open, unlink, rename, and readdir, potentially leading to denial of service and out-of-bounds reads when mounting untrusted media.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.