A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supplying a specially crafted EXT4 filesystem image with malformed directory entries. The code may fail to validate the directory entry pointer before accessing the name_len field, leading to a segmentation fault. The underlying weakness is a null pointer dereference, classified as CWE-476.

lwext4 1.0.0, the 2016-era codebase used in many embedded and Linux-based systems that implement EXT4 filesystem image handling. No other versions are known to be affected at this time.

The flaw results in a denial of service but does not provide remote code execution. The CVSS score of 7.5 indicates high severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve supplying a malicious EXT4 image to a system component that parses or mounts it, causing the application to crash. Given the lack of publicly known exploits and the severity of the denial of service, the risk is high for systems that load untrusted EXT4 images but otherwise moderate in the absence of exploitation evidence.