A flaw in barebox’s ext4 directory parsing allows a crafted filesystem image to cause the boot process to hang indefinitely. The ext4fs_iterate_dir() routine does not check that directory entry length values are non‑zero, so a malicious entry with a zero length can trigger an infinite loop while listing a directory or resolving a path. This results in a denial of service that halts the system before it can fully boot. The vulnerability is identified as CWE‑835, reflecting an infinite loop flaw.

All barebox releases prior to 2026.04.0 are affected. The issue resides in the barebox:barebox product line and applies to any firmware version that includes the ext4 file system support without the patch introduced in the 2026.04.0 release.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. The most apparent attack vector is the introduction of a malicious ext4 image during the boot sequence; thus the risk is confined to environments that boot from untrusted or user‑supplied images. Exploitation leads to a boot hang rather than privilege escalation or data compromise, limiting the impact to availability issues for the affected system.