CVE-2026-7007
- Source
- https://cve.org/CVERecord?id=CVE-2026-7007
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7007.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-7007
- Aliases
-
- GHSA-wrf2-79mm-cvw5
- Published
- 2026-07-24T13:48:24.831Z
- Modified
- 2026-07-29T08:20:18.176647Z
- Severity
-
- 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image
- Details
-
The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock() (subsys/fs/ext2/ext2impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and sinodespergroup are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.
During mount, getngroups() divides and modulos sblockscount by sblockspergroup (reached via ext2fetchblockgroup() from ext2initfs()), and getitableentry() divides (ino - 1) by sinodespergroup when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.
An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCBCCRDIV0TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.
The fix rejects a zero sblockspergroup or sinodespergroup in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.
- Database specific
{ "cna_assigner": "zephyr", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7007.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "3.5.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD" } ], "cwe_ids": [ "CWE-369" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7007.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrf2-79mm-cvw5
- https://nvd.nist.gov/vuln/detail/CVE-2026-7007
- https://github.com/zephyrproject-rtos/zephyr/commit/babc0900ed40e6c023ccc26aa1a321f9388b66af
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v1.*
v2.*
v3.*
v4.*
zephyr-v1.*
zephyr-v2.*
zephyr-v3.*
Database specific
vanir_signatures_modified
"2026-07-29T08:20:18Z"
vanir_signatures
[
{
"target": {
"function": "ext2_verify_disk_superblock",
"file": "subsys/fs/ext2/ext2_impl.c"
},
"id": "CVE-2026-7007-4595947f",
"digest": {
"function_hash": "5032105170135439344934508190680585980",
"length": 2396.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/babc0900ed40e6c023ccc26aa1a321f9388b66af"
},
{
"target": {
"file": "subsys/fs/ext2/ext2_impl.c"
},
"id": "CVE-2026-7007-8ac2e467",
"digest": {
"line_hashes": [
"152829234735664510806900942334217770278",
"44380234109013997380493403223582655635",
"6123786931226334703979409887514339352"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/babc0900ed40e6c023ccc26aa1a321f9388b66af"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7007.json"