CVE-2026-13478

The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s_blocks_count - s_first_data_block to ext2_bitmap_count_set(). That helper (subsys/fs/ext2/ext2_bitmap.c) treats its argument as a number of bits and reads one bitmap byte per eight bits, but the bitmap buffer (BGROUP_BLOCK_BITMAP) is a single fetched block of only fs->block_size bytes (capacity fs->block_size * 8 bits). s_blocks_count and s_first_data_block are taken verbatim from the superblock and were never bounded against this single-group capacity; ext2_verify_disk_superblock() checks the magic, revision, and block-size shift but not the block count. A crafted ext2 image with an oversized s_blocks_count (up to ~4 billion, against a maximum 4096-byte block / 32768-bit bitmap) makes ext2_bitmap_count_set() scan roughly 512 MB of memory past the bitmap block — a large out-of-bounds read of the static block slab and adjacent memory. The defect is reached during mount: ext2_init_fs() is invoked from ext2_mount() (subsys/fs/ext2/ext2_ops.c), the registered .mount operation. Any path that mounts an attacker-supplied ext2 image (removable media, a disk/flash partition, or a downloaded image) triggers it. The kernel-privileged parser operates on attacker-controlled data, so the bug is exploitable wherever untrusted ext2 media can be mounted. Impact is an out-of-bounds read only: the resulting bit count is compared internally and the mount is rejected, so no attacker-controlled bytes are returned (not a useful information leak). The ~512 MB over-read will almost certainly cross an unmapped or MPU-protected boundary and fault, crashing the system — a denial of service triggered by mounting a single malformed image. The fix rejects any image whose fs_blocks exceeds fs->block_size * 8 before the scan.

• CWE-125

• https://github.com/zephyrproject-rtos/zephyr/commit/9c0f869da07009d9d4bca7a99e995f9b8cea7da2
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gj29-7f7m-4c29

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13464The Kirki – Freeform Page Builder, Website Builder & Customi…5.3
• CVE-2026-13468The Visualizer – Tables & Charts Manager with Built-in AI Ge…7.5
• CVE-2026-13473IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.…9.8
• CVE-2026-13474Denial of service via malformed HTTP/2 requests in NetScaler…7.5
• CVE-2026-13476IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could all…7.3
• CVE-2026-13477IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 …8.8
• CVE-2026-13479The LoRaWAN application-layer clock-synchronization service …4.3
• CVE-2026-13480The LoRaWAN TS004 Fragmented Data Block Transport handler fr…3.1
• CVE-2026-13481The IEEE 1588 PTP management-message parser in subsys/net/li…5.4
• CVE-2026-13482A vulnerability was detected in skypilot-org skypilot up to …3.7
• CVE-2026-13483A flaw has been found in arc53 DocsGPT up to 0.18.0. The aff…3.1
• CVE-2026-13484A vulnerability has been found in MLflow up to 4666cffc7912e…8.8