{"id":"CVE-2026-7007","aliases":[],"cve":{"records":[{"id":"CVE-2026-7007","source":"zephyr","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-04-24T22:00:52.689Z","published":"2026-07-24T13:48:24.831Z","modified":"2026-11-04T04:58:59.468Z"}],"publishers":[{"name":"zephyr","role":"CNA","organizationId":"e2e69745-5e70-4e92-8431-deb5529a81ad","modified":"2026-11-04T04:58:59.468Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-07-24T15:04:01.152Z"}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/babc0900ed40e6c023ccc26aa1a321f9388b66af","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrf2-79mm-cvw5","tags":[],"source":"zephyr"}],"weaknesses":[{"id":"CWE-369","description":"dos","source":"zephyr"},{"id":"CWE-369","description":"CWE-369 Divide By Zero","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-07-24T15:03:26.497157Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image","titleSource":"zephyr","descriptionSource":"zephyr","description":"The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. Both fields are read directly from the image and are later used as divisors during mount-time initialization.\n\nDuring mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence.\n\nAn attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.\n\nThe fix rejects a zero s_blocks_per_group or s_inodes_per_group in the superblock validator, returning -EINVAL so the mount fails before any block-group or inode I/O occurs.","score":4.6,"severity":"medium","published":"2026-07-24T13:48:24.831Z","modified":"2026-11-04T04:58:59.468Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zephyrproject","name":"zephyr","platforms":[],"versions":[{"version":"3.5.0","status":"affected","lessThan":"4.3.2","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"zephyr","url":"https://www.cve.org/CVERecord?id=CVE-2026-7007"}],"remediation":[],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/babc0900ed40e6c023ccc26aa1a321f9388b66af","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrf2-79mm-cvw5"],"sources":[{"name":"CVE","id":"CVE-2026-7007","modified":"2026-11-04T04:58:59.468Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-7007"}],"assessments":[{"source":"zephyr","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":4.6}],"sourceAffected":[],"observedAt":"2026-11-04T05:10:26.142Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:50:31.991Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T08:40:31.135Z","attemptedAt":"2026-11-04T08:40:31.135Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-04T08:40:31.135Z","attemptedAt":"2026-11-04T08:40:31.135Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-04T08:40:31.135Z","attemptedAt":"2026-11-04T08:40:31.135Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-04T08:40:31.135Z","attemptedAt":"2026-11-04T08:40:31.135Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-48588","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48588","modified":"Nov 4, 2026, 4:58:59 AM","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-04T08:40:31.135Z"},{"source":"FIRST EPSS","id":"CVE-2026-7007","url":"https://www.first.org/epss/","probability":0.00243,"percentile":0.15608,"date":"2026-11-03","checkedAt":"2026-11-04T08:40:31.135Z"},{"source":"NVD","id":"CVE-2026-7007","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7007","modified":"2026-11-04T05:19:03.217","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-04T08:40:31.135Z"}],"aiSummary":{"text":"Zephyr versions 3.5.0 to 4.3.2 and 4.4.0 to 4.4.2 have a division by zero weakness in ext2 superblock parsing, allowing denial of service via crafted filesystem image. An attacker with access to present a crafted ext2 image can trigger this. The impact is limited to availability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T05:36:11.583Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-7007"}]}}