Executive brief
lwext4 is a lightweight library used to provide EXT4 filesystem support for embedded systems and small devices. A vulnerability in how the library handles directory information could allow a malicious actor to crash a system by providing a specially crafted, corrupted filesystem image. This results in a denial of service, potentially causing devices to reboot or stop functioning when they attempt to read the malicious data.
Technical details
A NULL pointer dereference exists in the ext4_dir_en_get_name_len function within include/ext4_dir.h of lwext4 1.0.0. The vulnerability is triggered during directory iteration when the library processes a malformed EXT4 filesystem image containing corrupted directory entries. Specifically, the ext4_dir_entry_next function may pass an invalid or NULL directory entry pointer to ext4_dir_en_get_name_len, which attempts to access the name_len field without prior validation. This results in a segmentation fault and subsequent denial of service. The issue was identified via fuzzing and affects the 2016-era codebase (commit 58bcf89).
Affected products
- gkostka lwext4 1.0.0
Timeline
- 2025-12-09: disclosed: Issue reported on GitHub repository
- 2026-06-01: advisory: CVE published to NVD