CVE-2026-34962
mediumpriority · track · 22EPSS 0.001 · 3 %ileEUUSEPSS · scored 2026-10-28
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/barebox/barebox/releases/Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-34962cnnvd
- https://github.com/barebox/bareboxenisa_euvd
- https://github.com/barebox/barebox/releases/tag/v2026.04.0enisa_euvd
- https://www.vulncheck.com/advisories/barebox-ext4-directory-parsing-infinite-loop-denial-of-serviceenisa_euvd
- https://y637f9qq2x.com/posts/barebox-sandbox-vulns/enisa_euvd
- https://github.com/barebox/bareboxProductnvd
- https://github.com/barebox/barebox/releases/tag/v2026.04.0Release Notesnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan