CVE-2026-7007
Received Received - Intake

Division by Zero in Zephyr RTOS ext2 File System

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Zephyr Project

Description
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor. The fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-7007
EUVD
EUVD-2026-48588

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr 4.5.0
zephyrproject zephyr From 3.5.0 (inc) to 4.4.1 (inc)
zephyrproject zephyr to 0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-369 The product divides a value by zero.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7007 is a divide-by-zero vulnerability in the Zephyr RTOS ext2 filesystem implementation. The issue occurs when the ext2 filesystem superblock contains zero values for the fields s_blocks_per_group or s_inodes_per_group. These fields are later used as divisors during filesystem mount operations, leading to division by zero errors.

Detection Guidance

To detect this vulnerability, inspect Zephyr RTOS systems using ext2 filesystem for superblocks with zero values in s_blocks_per_group or s_inodes_per_group fields. Check filesystem images or mounted volumes for these fields using hexdump or similar tools. For example, use 'hexdump -C <image> | grep -E "(blocks_per_group|inodes_per_group)"' to examine superblock values.

Impact Analysis

An attacker can exploit this by providing a crafted ext2 image with either field set to zero, triggering a division by zero during mount-time initialization. This causes a denial of service, particularly on ARMv7-M/ARMv8-M targets where divide-by-zero trapping is enabled, leading to a fatal UsageFault. Exploitation requires physical access to present the crafted image via removable media or other block devices.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.5.0 or later to apply the patch. Avoid mounting untrusted ext2 images, especially on ARMv7-M/ARMv8-M targets. Validate filesystem images before use and ensure superblock fields s_blocks_per_group and s_inodes_per_group are non-zero.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart