The vulnerability is an integer division by zero in the Zephyr ext2 file system. During mount, the superblock validator does not check that s_blocks_per_group and s_inodes_per_group are non‑zero. The mount process later uses these fields as divisors, and a zero value causes a division‑by‑zero fault when getting the number of groups or the inode table entry. The fault triggers a UsageFault in ARM Cortex‑M devices that have divide‑by‑zero trapping enabled, which Zephyr treats as a fatal error and results in a denial of service. The weakness is a classic CWE‑369 error causing a loss of availability.

Zephyr RTOS is the affected vendor and product. Devices running Zephyr that mount ext2 file systems on ARMv7‑M or ARMv8‑M mainline Cortex‑M processors are impacted. The CVE entry does not list specific firmware or kernel versions, so any build that supports ext2 and mounts untrusted images is potentially vulnerable until the update is applied.

The CVSS score is 4.6, indicating a moderate severity, and the EPSS score is less than 1%, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must supply a crafted ext2 image to a device that mounts it; based on the description, network privilege is not required. Because the fault occurs during mount, an exploit will stop the system from booting or using the filesystem, causing a denial of service. No network privilege is required, and the impact is limited to the attacking device.