Executive brief
Zephyr is an operating system designed for resource-constrained embedded devices. A vulnerability in its file system handling allows an attacker with physical access to crash a device by inserting a specially crafted SD card or USB drive. This results in a denial of service, potentially rendering the device inoperable until it is rebooted without the malicious media.
Technical details
A divide-by-zero vulnerability exists in the Zephyr ext2 filesystem implementation within `subsys/fs/ext2/ext2_impl.c`. The `ext2_verify_disk_superblock()` function fails to ensure that the `s_blocks_per_group` and `s_inodes_per_group` fields are non-zero. These values are subsequently used as divisors in `get_ngroups()` and `get_itable_entry()` during the mount process. An attacker can trigger this by presenting a crafted ext2 image via physical media (USB/SD). On ARM Cortex-M targets with divide-by-zero trapping enabled, this results in a UsageFault and fatal system error (DoS). The issue is fixed in Zephyr v4.5.0 by adding non-zero checks to the superblock validator.
Affected products
- zephyrproject-rtos zephyr >= 3.5.0, < 4.5.0
Timeline
- 2026-07-23: other: Embargo date
- 2026-07-24: advisory: GHSA-wrf2-79mm-cvw5 published
- 2026-07-24: disclosed: CVE-2026-7007 published