CVE-2026-10645

Modified Modified - Updated After Analysis

Out-of-Bounds Read in Zephyr RTOS ext2 Filesystem Parser

Publication date: 2026-06-23

Last updated on: 2026-07-14

Assigner: Zephyr Project

Description

The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_fetch_direntry() guarded only with de_name_len > EXT2_MAX_FILE_NAME, but de_name_len is a uint8_t and EXT2_MAX_FILE_NAME is 255, so the check is always false; the function then memcpy'd up to 255 name bytes and the lookup/readdir paths advanced traversal by an unvalidated de_rec_len. Each directory block is read into a block_size-sized slab buffer, and block_off can be driven near the block end by preceding entries' rec_len, so the 8-byte header read and the subsequent name memcpy can read up to ~263 bytes past the end of the block buffer into adjacent heap/slab memory. On the readdir path those bytes are returned to the caller in fs_dirent.name, leaking adjacent kernel heap memory; a de_rec_len of 0 also causes a zero-progress infinite loop (denial of service), and the unlink path's memmove(de, next, next_reclen) over unvalidated records is an additional OOB read/write source. The defect is reached by any path-based operation (open, stat, unlink, rename, mkdir) or directory listing on a mounted ext2 volume, so a crafted or corrupted ext2 image on attacker-supplied storage (SD card, USB mass storage, or otherwise mounted image) triggers it. Affected: Zephyr ext2 from its introduction in v3.5.0 through v4.4.0. The fix validates rec_len and name_len in the parser and rejects entries whose header does not fit the remaining block or whose rec_len crosses the block boundary in every traversal caller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-23

Last Modified

2026-07-14

Generated

2026-08-02

AI Q&A

2026-06-23

EPSS Evaluated

2026-08-01

NVD

CVE-2026-10645

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

The CVE-2026-10645 vulnerability in the Zephyr RTOS affects the ext2 filesystem implementation. The issue arises because the directory-entry parser in Zephyr's ext2 filesystem does not fully validate the structure of on-disk directory entries before processing them.

Specifically, the function ext2_fetch_direntry() fails to properly check the relationship between the directory entry's record length (de_rec_len), name length (de_name_len), and the directory block boundaries. This lack of validation can cause two main problems: an out-of-bounds read from the directory block buffer and an infinite loop during directory traversal when de_rec_len is zero.

The vulnerability is not triggered during filesystem mount but occurs later during directory operations such as pathname lookup, file operations (stat, open, unlink, rename), or reading directory contents.

Detection Guidance

This vulnerability arises from malformed ext2 filesystem images that cause out-of-bounds reads or infinite loops during directory traversal operations such as pathname lookup, stat, open, unlink, rename, or readdir.

Detection involves monitoring for abnormal behavior or crashes when accessing ext2 filesystems, especially those mounted from untrusted media or user-provided images.

Since the issue is triggered during directory traversal, commands that perform directory operations on ext2 mounts can be used to detect the vulnerability's effects, such as:

ls -l /path/to/ext2/mount
stat /path/to/ext2/mount/somefile
find /path/to/ext2/mount -type f
cat /path/to/ext2/mount/somefile

If these commands cause infinite loops, crashes, or out-of-bounds read faults, it may indicate the presence of the vulnerability triggered by a crafted ext2 image.

Impact Analysis

This vulnerability can lead to denial of service conditions by causing infinite loops or faults during directory traversal in the ext2 filesystem.

It can also cause out-of-bounds reads from the directory block buffer, which may result in undefined behavior or crashes.

While code execution has not been demonstrated, the primary realistic threat is denial of service or safety issues when mounting untrusted ext2 images from sources such as removable media, user-provided images, or over-the-air updates.

Compliance Impact

The CVE-2026-10645 vulnerability primarily leads to denial of service and out-of-bounds reads when processing crafted ext2 filesystem images. It does not directly involve unauthorized access to sensitive data or data breaches.

Because the vulnerability affects availability and parser safety rather than confidentiality or integrity of data, its impact on compliance with standards like GDPR or HIPAA—which focus heavily on protecting personal and sensitive information—is indirect and limited.

However, denial of service conditions caused by this vulnerability could potentially disrupt systems that handle regulated data, which might affect operational compliance requirements under such standards.

Mitigation Strategies

To mitigate this vulnerability, avoid mounting or accessing ext2 filesystem images from untrusted or user-provided sources such as removable media or OTA updates.

Apply the patches that have been merged into the Zephyr main branch and release branches (v4.4, v4.3, and v3.7) which fix the validation of directory entries in the ext2 filesystem implementation.

If patching immediately is not possible, restrict access to ext2 mounts and monitor for abnormal directory traversal behavior to prevent denial of service.

Hi! I’m here to help you understand CVE-2026-10645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70