PT-2026-39851 · Barebox · Barebox

Kazuma Matsumoto · CVE-2026-34962 · Published 2026-05-11 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions barebox versions prior to 2026.04.0

Description A denial-of-service issue exists in the ext4 directory parsing within fs/ext4/ext4 common.c. The ext4fs iterate dir() function does not validate that directory entry length values are non-zero. An attacker can provide a malicious ext4 filesystem image containing a crafted directory entry with a direntlen value of 0, triggering an infinite loop during path resolution or directory listing, which causes the boot process to hang indefinitely.

Recommendations Update to version 2026.04.0.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-34962

Affected Products

Barebox

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34962.json · Exploit
• https://github.com/barebox/barebox/releases/tag/v2026.04.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34962 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34962 · Vendor Advisory
• https://github.com/barebox/barebox · Note
• https://t.me/cveNotify/163364 · Telegram Post
• https://vulncheck.com/advisories/barebox-ext4-directory-parsing-infinite-loop-denial-of-service · Note
• https://t.me/CVEtracker/53427 · Telegram Post
• https://t.me/cveNotify/163142 · Telegram Post