Executive Summary

The CVE-2026-10645 vulnerability in the Zephyr RTOS affects the ext2 filesystem implementation. The issue arises because the directory-entry parser in Zephyr's ext2 filesystem does not fully validate the structure of on-disk directory entries before processing them.

Specifically, the function ext2_fetch_direntry() fails to properly check the relationship between the directory entry's record length (de_rec_len), name length (de_name_len), and the directory block boundaries. This lack of validation can cause two main problems: an out-of-bounds read from the directory block buffer and an infinite loop during directory traversal when de_rec_len is zero.

The vulnerability is not triggered during filesystem mount but occurs later during directory operations such as pathname lookup, file operations (stat, open, unlink, rename), or reading directory contents.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service conditions by causing infinite loops or faults during directory traversal in the ext2 filesystem.

It can also cause out-of-bounds reads from the directory block buffer, which may result in undefined behavior or crashes.

While code execution has not been demonstrated, the primary realistic threat is denial of service or safety issues when mounting untrusted ext2 images from sources such as removable media, user-provided images, or over-the-air updates.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from malformed ext2 filesystem images that cause out-of-bounds reads or infinite loops during directory traversal operations such as pathname lookup, stat, open, unlink, rename, or readdir.

Detection involves monitoring for abnormal behavior or crashes when accessing ext2 filesystems, especially those mounted from untrusted media or user-provided images.

Since the issue is triggered during directory traversal, commands that perform directory operations on ext2 mounts can be used to detect the vulnerability's effects, such as:

• ls -l /path/to/ext2/mount
• stat /path/to/ext2/mount/somefile
• find /path/to/ext2/mount -type f
• cat /path/to/ext2/mount/somefile

If these commands cause infinite loops, crashes, or out-of-bounds read faults, it may indicate the presence of the vulnerability triggered by a crafted ext2 image.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid mounting or accessing ext2 filesystem images from untrusted or user-provided sources such as removable media or OTA updates.

Apply the patches that have been merged into the Zephyr main branch and release branches (v4.4, v4.3, and v3.7) which fix the validation of directory entries in the ext2 filesystem implementation.

If patching immediately is not possible, restrict access to ext2 mounts and monitor for abnormal directory traversal behavior to prevent denial of service.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2026-10645 vulnerability primarily leads to denial of service and out-of-bounds reads when processing crafted ext2 filesystem images. It does not directly involve unauthorized access to sensitive data or data breaches.

Because the vulnerability affects availability and parser safety rather than confidentiality or integrity of data, its impact on compliance with standards like GDPR or HIPAA—which focus heavily on protecting personal and sensitive information—is indirect and limited.

However, denial of service conditions caused by this vulnerability could potentially disrupt systems that handle regulated data, which might affect operational compliance requirements under such standards.

Useful 0 Not Useful 0