CVE-2026-13215

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The ext2 filesystem driver fails to validate the s log block size field of the on-disk superblock during the filesystem mounting process. The function ext2 verify disk superblock() in subsys/fs/ext2/ext2 impl.c does not perform bounds checking on this field. Consequently, a crafted value can cause an overflow during the shift operation or result in a block size exceeding CONFIG EXT2 MAX BLOCK SIZE when calculating fs->block size in subsys/fs/ext2/ext2 ops.c.

This invalid block size is passed to k mem slab init() via ext2 init blocks slab(), which initializes a slab using the static buffer ext2 block memory buffer. Since k mem slab init() does not verify if the requested blocks fit the buffer and the return value is ignored, the slab is created beyond the buffer boundaries. This leads to an out-of-bounds write into adjacent static memory when the driver reads block-group, bitmap, and inode blocks. An attacker providing a crafted ext2 image via removable storage can trigger this supervisor-mode memory corruption, potentially leading to denial of service or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.