CVE-2026-10645: Zephyr ext2 Parser DoS Vulnerability

CVE-2026-10645 Overview

CVE-2026-10645 affects the Zephyr real-time operating system (RTOS) ext2 filesystem implementation. The ext2_fetch_direntry() function in subsys/fs/ext2/ext2_diskops.c fails to fully validate on-disk directory entry structure before copying the entry name and advancing traversal state. A crafted ext2 image mounted from untrusted media can trigger an out-of-bounds read or a zero-progress infinite loop during directory traversal. The flaw is classified as [CWE-125] Out-of-bounds Read.

Critical Impact
Attackers with physical access to supply a malicious ext2 image can cause denial of service or read adjacent memory contents through directory traversal operations on Zephyr-based devices.

Affected Products

Zephyr RTOS ext2 filesystem subsystem (subsys/fs/ext2)
Devices mounting ext2 filesystems from untrusted media
Embedded systems exposing removable storage interfaces using Zephyr

Discovery Timeline

2026-06-23 - CVE-2026-10645 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-10645

Vulnerability Analysis

The vulnerability resides in the ext2 directory-entry parser within Zephyr's filesystem subsystem. The ext2_fetch_direntry() function checks only that de_name_len <= EXT2_MAX_FILE_NAME before invoking memcpy on the entry name. The parser does not validate the structural relationship between de_rec_len, de_name_len, and the directory block boundary.

Callers including find_dir_entry() and ext2_get_direntry() in subsys/fs/ext2/ext2_impl.c advance traversal using the unvalidated de_rec_len field. The issue is not triggered at mount time. It surfaces later through pathname lookup, stat, open, unlink, rename, and readdir operations.

Root Cause

The parser omits three structural validations: that de_rec_len is non-zero, that de_rec_len is at least the size of the entry header, and that the record fits within the directory block. Without these checks, malformed entries propagate through traversal state. A directory entry near the end of a block with an oversized de_name_len causes memcpy to read past the block buffer.

Attack Vector

An attacker crafts an ext2 filesystem image containing malformed directory entries. The image is then mounted by the target Zephyr device through physical media such as an SD card or USB storage. Subsequent directory access triggers either an out-of-bounds read from the directory block buffer or an infinite loop when de_rec_len == 0. The CVSS vector indicates physical access with user interaction is required for exploitation.

No verified public proof-of-concept code is available. See the Zephyr GitHub Security Advisory GHSA-hwrh-9h3x-vccm for technical details.

Detection Methods for CVE-2026-10645

Indicators of Compromise

Unexpected device hangs or watchdog resets during filesystem operations on ext2 volumes
Application crashes triggered by readdir, stat, open, unlink, or rename calls against mounted external media
Kernel logs showing infinite loop conditions or memory faults within ext2_fetch_direntry() call paths

Detection Strategies

Audit firmware for the vulnerable ext2_fetch_direntry() implementation in subsys/fs/ext2/ext2_diskops.c
Implement filesystem image validation through fuzzing tools that exercise directory entry parsing
Monitor device telemetry for repeated abnormal terminations during directory enumeration on removable media

Monitoring Recommendations

Log all mount events involving external or user-supplied storage on Zephyr-based devices
Capture and review crash dumps that reference ext2 traversal functions for signs of malformed image exploitation
Track firmware versions across the fleet to identify devices running unpatched Zephyr builds

How to Mitigate CVE-2026-10645

Immediate Actions Required

Update Zephyr RTOS to a version containing the fix referenced in GHSA-hwrh-9h3x-vccm
Restrict mounting of ext2 filesystems to trusted, verified media sources only
Disable user-accessible removable storage interfaces on devices that do not require them

Patch Information

The Zephyr project has issued a security advisory. Consult the official Zephyr Security Advisory GHSA-hwrh-9h3x-vccm for patch commits and affected version ranges. Rebuild and reflash firmware with the patched ext2 subsystem.

Workarounds

Disable the ext2 filesystem in Zephyr build configuration (CONFIG_FILE_SYSTEM_EXT2) where it is not required
Use an alternative filesystem such as FAT or LittleFS for removable media when feasible
Enforce cryptographic verification of filesystem images prior to mount on production devices
Implement physical security controls preventing unauthorized media insertion into deployed devices

bash

# Disable ext2 support in Zephyr build configuration
# In prj.conf or board configuration:
CONFIG_FILE_SYSTEM_EXT2=n