CVE-2026-13478
Received Received - Intake

Out-of-Bounds Read in Zephyr RTOS ext2 Filesystem Driver

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Zephyr Project

Description
The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_block to ext2_bitmap_count_set(). That helper (subsys/fs/ext2/ext2_bitmap.c) treats its argument as a number of bits and reads one bitmap byte per eight bits, but the bitmap buffer (BGROUP_BLOCK_BITMAP) is a single fetched block of only fs->block_size bytes (capacity fs->block_size * 8 bits). s_blocks_count and s_first_data_block are taken verbatim from the superblock and were never bounded against this single-group capacity; ext2_verify_disk_superblock() checks the magic, revision, and block-size shift but not the block count. A crafted ext2 image with an oversized s_blocks_count (up to ~4 billion, against a maximum 4096-byte block / 32768-bit bitmap) makes ext2_bitmap_count_set() scan roughly 512 MB of memory past the bitmap block — a large out-of-bounds read of the static block slab and adjacent memory. The defect is reached during mount: ext2_init_fs() is invoked from ext2_mount() (subsys/fs/ext2/ext2_ops.c), the registered .mount operation. Any path that mounts an attacker-supplied ext2 image (removable media, a disk/flash partition, or a downloaded image) triggers it. The kernel-privileged parser operates on attacker-controlled data, so the bug is exploitable wherever untrusted ext2 media can be mounted. Impact is an out-of-bounds read only: the resulting bit count is compared internally and the mount is rejected, so no attacker-controlled bytes are returned (not a useful information leak). The ~512 MB over-read will almost certainly cross an unmapped or MPU-protected boundary and fault, crashing the system — a denial of service triggered by mounting a single malformed image. The fix rejects any image whose fs_blocks exceeds fs->block_size * 8 before the scan.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-13478
EUVD
EUVD-2026-65599

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr From 3.5.0 (inc) to 4.4.1 (inc)
zephyrproject zephyr 4.4.2
zephyr_project zephyr *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-13478 is an out-of-bounds read vulnerability in the Zephyr RTOS ext2 filesystem driver. It occurs when the driver validates the block bitmap in a crafted ext2 image. The driver calculates fs_blocks as s_blocks_count minus s_first_data_block and passes this value to a helper function that treats it as a bit count. However, the bitmap buffer is limited to fs->block_size * 8 bits, so an oversized s_blocks_count (up to ~4 billion) causes the helper to scan roughly 512 MB past the bitmap block, leading to a large out-of-bounds read.

Detection Guidance

This vulnerability is triggered when mounting a crafted ext2 filesystem image. To detect it, inspect mounted ext2 filesystems for malformed superblocks or excessive block counts. Check Zephyr RTOS versions between 3.5.0 and 4.4.1 for affected systems. Use commands like 'mount' to list filesystems and 'dmesg' after mounting untrusted media to look for crashes or memory access violations.

Impact Analysis

This vulnerability can cause a denial of service by crashing the system when a malformed ext2 image is mounted. The crash occurs because the out-of-bounds read will likely cross an unmapped or protected memory boundary. The attack requires local access to mount untrusted ext2 media, such as removable media or a disk partition. It does not allow privilege escalation or information disclosure.

Compliance Impact

This vulnerability primarily impacts system availability by causing a denial of service through system crashes when mounting crafted ext2 images. It does not lead to unauthorized data access or disclosure, which are key concerns under GDPR or HIPAA. However, repeated crashes could disrupt services handling sensitive data, potentially affecting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later to apply the patch. Avoid mounting untrusted ext2 filesystem images until patched. If upgrading is not possible, restrict access to mounting operations or block ext2 filesystem mounts entirely. Monitor system logs for crashes during filesystem mounting as potential indicators of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart