PatchSiren cyber security CVE debrief
CVE-2026-7007 zephyrproject CVE debrief
The Zephyr ext2 file system has a division by zero vulnerability. The ext2_verify_disk_superblock() function does not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. An attacker who can present a crafted ext2 image can trigger this, causing a denial of service on ARMv7-M / ARMv8-M-mainline Cortex-M targets. The vulnerability is triggered when the ext2 file system is mounted, and the impact is limited to availability.
- Vendor
- zephyrproject
- Product
- zephyr
- CVSS
- MEDIUM 4.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-24
- Original CVE updated
- 2026-07-27
- Advisory published
- 2026-07-24
- Advisory updated
- 2026-07-27
Who should care
Developers and users of the Zephyr operating system who use the ext2 file system should be aware of this vulnerability and take steps to defend against it. This includes reviewing and applying patches, verifying the integrity of removable media, and monitoring system logs for denial of service errors.
Technical summary
The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing a mount. However, it does not verify that the on-disk fields s_blocks_per_group and s_inodes_per_group are non-zero. During mount, get_ngroups() divides and modulos s_blocks_count by s_blocks_per_group (reached via ext2_fetch_block_group() from ext2_init_fs()), and get_itable_entry() divides (ino - 1) by s_inodes_per_group when fetching the root inode (both in subsys/fs/ext2/ext2_diskops.c). A superblock with either field set to zero therefore causes an integer division by zero during the mount sequence. An attacker who can present a crafted ext2 image to a device that mounts ext2 — removable media such as an SD card or a USB mass-storage device — can trigger this. On ARMv7-M / ARMv8-M-mainline Cortex-M targets, divide-by-zero trapping is enabled (SCB_CCR_DIV_0_TRP), so the division raises a UsageFault that Zephyr treats as a fatal error, producing a denial of service. The impact is limited to availability; the malformed value is consumed only as a divisor.
Defensive priority
High
Recommended defensive actions
- Review and apply the patch to reject a zero s_blocks_per_group or s_inodes_per_group in the superblock validator
- Verify that the Zephyr operating system and ext2 file system are up to date
- Use secure removable media and USB mass-storage devices
- Monitor system logs for denial of service errors
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-24T15:19:08.047Z and was last modified on 2026-07-27T20:32:27.703Z. The NVD entry is currently Awaiting Analysis. The vulnerability was reported by an external researcher and is based on limited information. Further analysis and verification are recommended.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-24T15:19:08.047Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.