CVE-2026-7007

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The ext2 file system fails to verify that the on-disk superblock fields s blocks per group and s inodes per group are non-zero during the mount process in the ext2 verify disk superblock() function. These fields are read directly from the image and used as divisors in the get ngroups() and get itable entry() functions. An attacker providing a crafted ext2 image via removable media, such as an SD card or USB mass-storage device, can trigger an integer division by zero. On ARMv7-M and ARMv8-M-mainline Cortex-M targets, this results in a UsageFault, leading to a denial of service.

Recommendations Update the software to a version where the ext2 verify disk superblock() function rejects zero values for s blocks per group and s inodes per group. As a temporary mitigation, avoid mounting ext2 images from untrusted removable media.