CVE-2026-13478: Zephyr ext2 Filesystem Driver DoS Vulnerability

CVE-2026-13478 Overview

CVE-2026-13478 is an out-of-bounds read vulnerability in the Zephyr Project real-time operating system (RTOS) ext2 filesystem driver. The defect resides in ext2_init_fs() within subsys/fs/ext2/ext2_impl.c, which passes an unbounded block count to ext2_bitmap_count_set(). A crafted ext2 image with an oversized s_blocks_count value forces the bitmap scanner to read approximately 512 MB of memory past the single fetched bitmap block. The over-read crosses the static block slab and adjacent memory, almost certainly hitting an unmapped or MPU-protected region and faulting the kernel.

Critical Impact
Mounting a single malformed ext2 image from removable media, a flash partition, or a downloaded file crashes the Zephyr kernel, producing a denial of service on the affected device.

Affected Products

Zephyr RTOS ext2 filesystem driver (subsys/fs/ext2)
Zephyr builds exposing ext2_mount() as a registered .mount operation
Embedded devices accepting attacker-supplied ext2 images via removable media or downloads

Discovery Timeline

2026-08-25 - CVE-2026-13478 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13478

Vulnerability Analysis

The Zephyr ext2 driver computes fs_blocks = s_blocks_count - s_first_data_block using values read verbatim from the superblock. It then calls ext2_bitmap_count_set() in subsys/fs/ext2/ext2_bitmap.c, which interprets its argument as a bit count and reads one byte per eight bits. The BGROUP_BLOCK_BITMAP buffer, however, is a single fetched block of only fs->block_size bytes, providing capacity for fs->block_size * 8 bits. A crafted image can set s_blocks_count up to approximately four billion against a maximum 32,768-bit bitmap for a 4096-byte block. The helper then scans roughly 512 MB of memory past the bitmap.

Root Cause

The root cause is missing bounds validation between s_blocks_count and the single-group bitmap capacity. The ext2_verify_disk_superblock() routine validates the magic value, revision, and block-size shift but never checks the block count against the buffer size. This maps to [CWE-125] out-of-bounds read, where a size taken from attacker-controlled input drives a memory scan without capacity enforcement.

Attack Vector

The defect is reached during mount. ext2_init_fs() is invoked from ext2_mount() in subsys/fs/ext2/ext2_ops.c, which is the registered .mount operation. Any code path that mounts an attacker-supplied ext2 image triggers the scan. Practical delivery vectors include removable media, a disk or flash partition prepared by an attacker with local access, and downloaded images processed by application logic. The parser executes with kernel privilege on attacker-controlled bytes, so exploitation requires only that untrusted ext2 media reach the mount operation. The out-of-bounds read does not return attacker-controlled bytes to the caller, so it is not a useful information leak; the mount is rejected after the bit count is compared. The realized impact is a kernel fault and system crash.

 	struct ext2_superblock *sb = &fs->sblock;
 	uint32_t fs_blocks = sb->s_blocks_count - sb->s_first_data_block;
 
+	if (fs_blocks > (uint32_t)(fs->block_size * 8U)) {
+		error_behavior(fs, "s_blocks_count exceeds single-group bitmap capacity");
+		return -EINVAL;
+	}
+
 	set = ext2_bitmap_count_set(BGROUP_BLOCK_BITMAP(&fs->bgroup), fs_blocks);
 
 	if (set != sb->s_blocks_count - sb->s_free_blocks_count - sb->s_first_data_block) {

Source: Zephyr commit 9c0f869da07009d9d4bca7a99e995f9b8cea7da2. The patch rejects any image whose fs_blocks exceeds fs->block_size * 8 before the scan.

Detection Methods for CVE-2026-13478

Indicators of Compromise

Unexpected kernel faults, MPU exceptions, or watchdog resets occurring immediately after a mount operation on ext2 media.
Presence of ext2 images on removable media or partitions whose superblock s_blocks_count exceeds block_size * 8.
Application or firmware logs showing calls to ext2_mount() followed by an abrupt reboot or crash dump.

Detection Strategies

Validate ext2 superblocks offline before mounting, comparing s_blocks_count - s_first_data_block against block_size * 8.
Instrument firmware to log the superblock fields read by ext2_verify_disk_superblock() and alert on out-of-range values.
Correlate device crash telemetry with recent media insertion or image download events.

Monitoring Recommendations

Track firmware crash and reboot rates on fleets that permit mounting user-supplied ext2 media.
Monitor filesystem mount return codes and surface -EINVAL results from ext2_init_fs() after the patch is applied.
Review supply chain and update channels that deliver disk images to embedded devices for integrity signatures.

How to Mitigate CVE-2026-13478

Immediate Actions Required

Apply Zephyr commit 9c0f869da07009d9d4bca7a99e995f9b8cea7da2 to reject oversized s_blocks_count values before the bitmap scan.
Rebuild and reflash affected devices with the patched Zephyr tree, prioritizing devices that mount removable or downloaded ext2 media.
Restrict mount operations to trusted, signed images until the fix is deployed.

Patch Information

The fix is available in the Zephyr commit adding the bitmap capacity check and is described in GitHub Security Advisory GHSA-gj29-7f7m-4c29. The patch enforces fs_blocks <= fs->block_size * 8 in ext2_init_fs() and returns -EINVAL when the bound is exceeded.

Workarounds

Disable the ext2 filesystem driver in Zephyr configuration where ext2 support is not required.
Reject removable media auto-mount at the application layer and require explicit user authorization for mount operations.
Pre-validate ext2 images with a userspace tool that checks superblock fields against single-group bitmap capacity before passing them to the kernel.

bash

# Disable ext2 support in the Zephyr build configuration
CONFIG_FILE_SYSTEM_EXT2=n