CVE-2026-10645 – fs: ext2: Missing structural validation of directory entries can cause out-of-bounds read and zero-progress directory traversal

CVE ID :CVE-2026-10645

Published : June 22, 2026, 11:48 p.m. | 1 hour, 55 minutes ago

Description :Zephyr’s ext2 directory-entry parser does not fully validate on-disk directory entry structure before copying the entry name and advancing traversal state. In ext2_fetch_direntry() (subsys/fs/ext2/ext2_diskops.c), the code only checks de_name_len
Severity: 4.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…