CVE-2026-7007: Zephyr ext2 File System DOS Vulnerability

CVE-2026-7007 Overview

CVE-2026-7007 is a divide-by-zero flaw [CWE-369] in the Zephyr real-time operating system's ext2 file system implementation. The ext2_verify_disk_superblock() function in subsys/fs/ext2/ext2_impl.c fails to validate that the on-disk s_blocks_per_group and s_inodes_per_group fields are non-zero. These fields are later used as divisors during mount-time initialization. An attacker with physical access can present a crafted ext2 image via removable media such as an SD card or USB mass-storage device. On ARMv7-M and ARMv8-M-mainline Cortex-M targets with divide-by-zero trapping enabled, the resulting UsageFault causes a fatal error and denial of service.

Critical Impact
A crafted ext2 image on removable media triggers an integer division-by-zero during mount, producing a UsageFault that Zephyr treats as fatal and halts the affected device.

Affected Products

Zephyr Project RTOS ext2 file system subsystem (subsys/fs/ext2)
ARMv7-M and ARMv8-M-mainline Cortex-M targets with SCB_CCR_DIV_0_TRP enabled
Devices mounting ext2 volumes from removable media (SD card, USB mass storage)

Discovery Timeline

2026-07-24 - CVE-2026-7007 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-7007

Vulnerability Analysis

The Zephyr ext2 driver validates the superblock before completing a mount. The existing validator checks the magic number, block size, revision, and feature flags. It does not verify that s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the untrusted disk image.

During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group. This path is reached via ext2_fetch_block_group() from ext2_init_fs(). Separately, get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode. Both functions live in subsys/fs/ext2/ext2_diskops.c.

The impact is limited to availability. The malformed values are only consumed as divisors, so confidentiality and integrity are unaffected.

Root Cause

The root cause is missing input validation on attacker-controlled disk metadata. The superblock validator accepts zero-valued group divisors that later feed integer division operations. This maps to CWE-369 (Divide By Zero).

Attack Vector

An attacker who can present a crafted ext2 image to a Zephyr device that mounts ext2 triggers the fault. On Cortex-M targets, the ARM architecture's divide-by-zero trap (SCB_CCR_DIV_0_TRP) raises a UsageFault. Zephyr treats this UsageFault as a fatal error, producing a denial of service on the target device. The attack requires physical access to insert removable media.

 		return -ENOTSUP;
 	}
 
+	/* Reject zero divisors used during block-group and inode lookup. */
+	if (sys_le32_to_cpu(sb->s_blocks_per_group) == 0 ||
+	    sys_le32_to_cpu(sb->s_inodes_per_group) == 0) {
+		LOG_ERR("Invalid superblock: s_blocks_per_group or s_inodes_per_group is zero");
+		return -EINVAL;
+	}
+
 	/* Check if file system may contain errors. */
 	if (sys_le16_to_cpu(sb->s_state) == EXT2_ERROR_FS) {
 		LOG_WRN("File system may contain errors.");

Source: Zephyr commit babc0900 — the patch rejects zero-valued group divisors in the superblock validator with -EINVAL before any block-group or inode I/O occurs.

Detection Methods for CVE-2026-7007

Indicators of Compromise

Unexpected UsageFault exceptions logged during ext2 mount operations on Cortex-M devices.
Device reboots or hard-fault crashes correlated with insertion of removable media containing ext2 volumes.
Log entries from Zephyr's fatal error handler referencing division exceptions in ext2_fetch_block_group() or get_itable_entry().

Detection Strategies

Inspect ext2 disk images offline and verify that s_blocks_per_group and s_inodes_per_group are non-zero before allowing mount.
Audit firmware images to confirm the Zephyr version in use includes the fix in ext2_verify_disk_superblock().
Monitor Zephyr fatal error telemetry for UsageFault reason codes during mount sequences.

Monitoring Recommendations

Aggregate device crash logs from fleet management systems and alert on repeated ext2 mount failures.
Track removable media insertion events on devices that support hot-plug storage.
Correlate device reboots with recent storage attach events to identify targeted DoS attempts.

How to Mitigate CVE-2026-7007

Immediate Actions Required

Update Zephyr to a release containing commit babc0900ed40e6c023ccc26aa1a321f9388b66af.
Restrict physical access to devices that mount ext2 from removable media.
Disable ext2 auto-mount on production devices that do not require it.

Patch Information

The upstream fix is available in the Zephyr commit babc0900. The patch adds an explicit check in ext2_verify_disk_superblock() that rejects any superblock where s_blocks_per_group or s_inodes_per_group is zero, returning -EINVAL and aborting the mount before further I/O. Additional context is available in the Zephyr GHSA-wrf2-79mm-cvw5 advisory.

Workarounds

Disable the ext2 file system subsystem in Zephyr's Kconfig if the application does not require it.
Use tamper-evident enclosures to detect insertion of unauthorized removable media.
Where feasible, disable the ARM SCB_CCR_DIV_0_TRP divide-by-zero trap only after evaluating tradeoffs; this converts the fault to undefined quotient behavior rather than a fix.

bash

# Verify Zephyr source contains the fix
grep -n "s_blocks_per_group\|s_inodes_per_group" \
    subsys/fs/ext2/ext2_impl.c

# Disable ext2 support in prj.conf if not required
echo "CONFIG_FILE_SYSTEM_EXT2=n" >> prj.conf