CVE-2026-10645

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10645
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10645.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10645
Aliases
  • GHSA-hwrh-9h3x-vccm
Downstream
Published
2026-06-22T23:48:11Z
Modified
2026-11-05T08:04:00Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
Summary
Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image
Details

The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block. ext2_fetch_direntry() guarded only with de_name_len > EXT2_MAX_FILE_NAME, but de_name_len is a uint8_t and EXT2_MAX_FILE_NAME is 255, so the check is always false; the function then memcpy'd up to 255 name bytes and the lookup/readdir paths advanced traversal by an unvalidated de_rec_len. Each directory block is read into a block_size-sized slab buffer, and block_off can be driven near the block end by preceding entries' rec_len, so the 8-byte header read and the subsequent name memcpy can read up to ~263 bytes past the end of the block buffer into adjacent heap/slab memory. On the readdir path those bytes are returned to the caller in fs_dirent.name, leaking adjacent kernel heap memory; a de_rec_len of 0 also causes a zero-progress infinite loop (denial of service), and the unlink path's memmove(de, next, next_reclen) over unvalidated records is an additional OOB read/write source. The defect is reached by any path-based operation (open, stat, unlink, rename, mkdir) or directory listing on a mounted ext2 volume, so a crafted or corrupted ext2 image on attacker-supplied storage (SD card, USB mass storage, or otherwise mounted image) triggers it. Affected: Zephyr ext2 from its introduction in v3.5.0 through v4.4.0. The fix validates rec_len and name_len in the parser and rejects entries whose header does not fit the remaining block or whose rec_len crosses the block boundary in every traversal caller.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10645.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "3.5.0"
                        },
                        {
                            "fixed": "4.6.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "last_affected": "255"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
a6eef0ba3755f2530c5ce93524e5ac4f5be30194
Fixed
7cdb534a3c3daeaec18f656953857dcafa33a2bf
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.5.0"
                },
                {
                    "last_affected": "4.4.0"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "fixed": "7cdb534a3c3daeaec18f656953857dcafa33a2bf"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v3.*
v3.5.0
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v3.*
zephyr-v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10645.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "72125976046614454152745583994117699953",
                "88439995128078707204315900745560676922",
                "86298374511934821593328838101936879501",
                "200392031327620180397513873000606348402",
                "213466435256523076395091935318052211828",
                "338672209896051553428396682622090557809",
                "194807484528107781421739608670650957946",
                "84680147492066068765323437990634983191",
                "339317784468652783698657959196353439206",
                "120610931510468348645292671876629730471",
                "242791636351866579458880614959948379801"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-10645-21162523",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_diskops.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "177041727999419695375936196332805616648",
            "length": 462
        },
        "id": "CVE-2026-10645-5801c26a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_impl.c",
            "function": "can_unlink"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "136367170898337329806207686100562090853",
            "length": 1275
        },
        "id": "CVE-2026-10645-93989a1b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_impl.c",
            "function": "ext2_del_direntry"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "60980272987108531823464566491675845259",
            "length": 1520
        },
        "id": "CVE-2026-10645-b3f0ef84",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_impl.c",
            "function": "ext2_get_direntry"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "208993760331804068324552727223482145304",
            "length": 565
        },
        "id": "CVE-2026-10645-c254123b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_diskops.c",
            "function": "ext2_fetch_direntry"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "314393921873035216186995745739121158977",
            "length": 797
        },
        "id": "CVE-2026-10645-dce861c8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_impl.c",
            "function": "find_dir_entry"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "79869407825858477610969251700948763656",
                "67627478043716570726794609254834822565",
                "162576676519163916092721671176924896779",
                "192016063086339181221316417729715972515",
                "29334261495434712167985109327413472468",
                "127553970083425473565747750083278135047",
                "241770021186444094684435341972556185976",
                "39584663994363082416398877717372706082",
                "226788625495595691401837446226090641690",
                "42559341474745603020947734129596634101",
                "238463574931320116993686421078245389898",
                "165854183690233571830633922862052338682",
                "280406082287298320180924832336644761769",
                "71804936159512133140841275771404573702",
                "160462514113081949384924536655023767187",
                "89900555191756016131950426893231403897",
                "135084700267061553524539753462038401667",
                "285177642633943081606757100304594410341",
                "118198381561981749455727203519855857033",
                "195430276866725284425887868649976663788",
                "279207802586649111212713688942939748032",
                "246200996370841551062546455156788650780",
                "156665630841018646270027828434575992113",
                "268691323971086497094875504345239900879",
                "323334473610978919165327495145076497990",
                "295969876873849297231663095662417143012",
                "228746866847002648015720686968073378604",
                "15870999006191001655851355583881663314",
                "123240505102858590667703847498875614696",
                "323743647363943587202705306774368443844",
                "157096771210142157098151135206080499436",
                "107571301110561020597329569040979505291",
                "246860423132717172291719207806164059125",
                "255857298894328094391856049307663733769",
                "43764041950823354414495384852876948361",
                "42403267706281255648217882793752884822",
                "154959634712191087715088963960522996723",
                "323561049675289333543038624308219551087",
                "301856108028345171800056075576414257679",
                "54523408253058618488116145814102088004",
                "7744408812521164970013753466066130026",
                "130140329046492610435449553531526521772",
                "69084601037162546411558012128316197340",
                "327574159562453597504864077099667809809",
                "179640237631312199829637172044161285407",
                "34964275265396594595799117827368126810",
                "22023513694424022372886812693671906194",
                "68435685530842106110043568450993481641"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-10645-fa7f5d9f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_impl.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "200560041784360674645872529341100063019",
            "length": 1568
        },
        "id": "CVE-2026-10645-fb5c00e7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/7cdb534a3c3daeaec18f656953857dcafa33a2bf",
        "target": {
            "file": "subsys/fs/ext2/ext2_impl.c",
            "function": "ext2_add_direntry"
        }
    }
]
vanir_signatures_modified 
"2026-11-05T08:04:00Z"