CVE-2026-34962: Pengutronix Barebox DoS Vulnerability

CVE-2026-34962 Overview

CVE-2026-34962 is a denial-of-service vulnerability in barebox, an open-source bootloader maintained by Pengutronix and widely used in embedded Linux systems. The flaw resides in the ext4 directory parsing logic within fs/ext4/ext4_common.c, specifically the ext4fs_iterate_dir() function. The function fails to validate that directory entry length values are non-zero. An attacker who can supply a malicious ext4 filesystem image can trigger an infinite loop during directory listing or path resolution, causing the boot process to hang indefinitely. The issue is categorized under CWE-835 (Loop with Unreachable Exit Condition). It affects barebox versions prior to 2026.04.0.

Critical Impact

A crafted ext4 image causes ext4fs_iterate_dir() to loop indefinitely, hanging the bootloader and preventing the device from starting.

Affected Products

• Pengutronix barebox versions prior to 2026.04.0
• Embedded Linux platforms relying on barebox ext4 filesystem support
• Devices booting from attacker-influenced ext4 media (SD cards, USB, eMMC partitions)

Discovery Timeline

• 2026-05-11 - CVE-2026-34962 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34962

Vulnerability Analysis

The vulnerability exists in ext4fs_iterate_dir() within fs/ext4/ext4_common.c. The function walks directory entries within an ext4 filesystem by advancing a pointer using the direntlen field of each entry. When direntlen is zero, the pointer never advances, and the loop continues indefinitely on the same entry. Because this parsing occurs during early boot operations such as directory listing or path resolution, the bootloader stalls before handing control to the operating system. The attack does not require authentication or user interaction beyond presenting the crafted filesystem to the boot path. Recovery typically requires physical intervention to replace or repair the storage media. The vulnerability impacts availability only; confidentiality and integrity are not affected per the CVSS vector.

Root Cause

The root cause is missing input validation on untrusted filesystem metadata. ext4fs_iterate_dir() trusts the direntlen value embedded in each on-disk directory entry without enforcing the ext4 specification requirement that this length be non-zero and properly aligned. A zero-length entry violates the loop's implicit progression invariant, satisfying the conditions described in CWE-835.

Attack Vector

Exploitation requires local access to provide a malicious ext4 image to the device. This includes inserting attacker-controlled removable media, modifying a writable boot partition, or flashing crafted firmware to non-volatile storage that barebox parses during boot. Once the malicious image is mounted and a directory operation is initiated, the bootloader enters an infinite loop and remains unresponsive until reset. Repeated resets continue to trigger the same condition as long as the malicious image is present.

No verified proof-of-concept code is publicly available. See the VulnCheck Advisory on Barebox for additional technical context.

Detection Methods for CVE-2026-34962

Indicators of Compromise

• Boot process stalls at the barebox stage when an ext4 volume is parsed, with no kernel handoff occurring.
• Watchdog-triggered reboot loops that consistently halt during filesystem enumeration.
• Presence of ext4 directory entries with a rec_len (direntlen) field of 0 in attached storage images.

Detection Strategies

• Inventory all embedded devices running barebox and compare installed versions against 2026.04.0 using build manifests or update servers.
• Perform offline static analysis of ext4 images supplied to boot media using tools such as debugfs or e2fsck to flag malformed directory entries.
• Add boot-time telemetry from device management platforms to flag systems that fail to progress past bootloader stages within expected time windows.

Monitoring Recommendations

• Monitor fleet boot health metrics for anomalous increases in devices that fail to reach the operating system stage.
• Log and alert on physical access events to embedded devices, including removable media insertion and recovery-mode entries.
• Validate firmware and boot partition integrity during routine maintenance cycles using cryptographic hashes from trusted builds.

How to Mitigate CVE-2026-34962

Immediate Actions Required

• Upgrade barebox to version 2026.04.0 or later across all affected devices and embedded product lines.
• Restrict physical access to embedded systems and disable boot from removable or untrusted media where operationally feasible.
• Verify the authenticity of ext4 images written to boot partitions using signed update mechanisms.

Patch Information

Pengutronix addressed the vulnerability in barebox release 2026.04.0. Refer to the GitHub Release v2026.04.0 for the patched source and the GitHub Project Repository for build instructions. Vendors integrating barebox into product firmware should rebuild and re-sign their boot images against the fixed version.

Workarounds

• Disable ext4 filesystem support in barebox builds where it is not required, removing the vulnerable code path.
• Enforce verified boot or signed-image policies so the bootloader rejects unauthorized ext4 volumes.
• Lock down hardware enclosures and disable external boot interfaces such as USB and SD on production units.

# Configuration example - rebuild barebox from the patched tag
git clone https://github.com/barebox/barebox.git
cd barebox
git checkout v2026.04.0
make <your_board>_defconfig
make