The Zephyr ext2 filesystem driver validates the on‑disk directory entry fields de_rec_len and de_name_len incorrectly. The check that de_name_len is greater than EXT2_MAX_FILE_NAME is always false because de_name_len is an 8‑bit value and the maximum file name length is 255, so the driver copy loop can read up to 255 bytes without verifying the actual length. When a directory block is read into a slab buffer exactly the size of the block, a preceding entry with a large rec_len can move the offset close to the block end. The subsequent 8‑byte header read and the name copy then read up to roughly 263 bytes past the buffer, leaking adjacent kernel heap memory through the readdir path. A de_rec_len value of zero also causes a zero‑progress infinite loop, resulting in a denial of service. The unlink path contains an additional out‑of‑bounds read/write source when memmove operates on unvalidated records. These weaknesses together allow an attacker to gain confidential information from the kernel heap and, if the infinite loop is triggered, to crash the system.

The flaw resides within Zephyr RTOS’s ext2 filesystem driver. Any Zephyr instance that mounts an ext2 volume from media supplied by an attacker is vulnerable. The affected releases span Zephyr ext2 from its introduction in version 3.5.0 through version 4.4.0.

The CVSS score of 4.9 classifies this issue as moderate severity. The EPSS score of <1% indicates a very low but nonzero chance of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not actively exploited. Based on the description, it is inferred that an attacker must supply a crafted ext2 image and gain sufficient privilege to mount it on the Zephyr device, typically via physical or network access to the device’s storage media such as an SD card or USB drive. The likely attack vector is therefore local or remote depending on the ability to place the malicious image on a device that will mount it, and the exploitation likelihood remains low without a privileged foothold.