CVE-2025-70099

A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supplying a specially crafted EXT4 filesystem image with malformed directory entries. During directory iteration, the code may fail to validate the directory entry pointer before accessing the name_len field, resulting in a segmentation fault. This affects versions based on (or equivalent to) the 2016-era codebase (1.0.0).

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gkostka/lwext4/issues/89
https://github.com/sigdevel/pocs/blob/main/res/lwext4/1/sig11_2_1_lwext4_ext4_dir_h_126
https://infosec.exchange/@sigdevel/116668939725424227
http://www.openwall.com/lists/oss-security/2026/06/29/4
https://github.com/gkostka/lwext4/issues/89

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-01 21:16

Updated : 2026-07-22 08:10

NVD link : CVE-2025-70099

Mitre link : CVE-2025-70099

CVE.ORG link : CVE-2025-70099

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-70099", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70099", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T15:19:41.112738Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-01T21:16:24.187", "references": [{"url": "https://github.com/gkostka/lwext4/issues/89", "source": "cve@mitre.org"}, {"url": "https://github.com/sigdevel/pocs/blob/main/res/lwext4/1/sig11_2_1_lwext4_ext4_dir_h_126", "source": "cve@mitre.org"}, {"url": "https://infosec.exchange/@sigdevel/116668939725424227", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/29/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/gkostka/lwext4/issues/89", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supplying a specially crafted EXT4 filesystem image with malformed directory entries. During directory iteration, the code may fail to validate the directory entry pointer before accessing the name_len field, resulting in a segmentation fault. This affects versions based on (or equivalent to) the 2016-era codebase (1.0.0)."}, {"lang": "es", "value": "Una desreferencia de puntero NULL en la funci\u00f3n ext4_dir_en_get_name_len en include/ext4_dir.h de lwext4 1.0.0 permite a los atacantes causar una denegaci\u00f3n de servicio al proporcionar una imagen de sistema de archivos EXT4 especialmente dise\u00f1ada con entradas de directorio malformadas. Durante la iteraci\u00f3n del directorio, el c\u00f3digo puede no validar el puntero de entrada del directorio antes de acceder al campo name_len, lo que resulta en una falla de segmentaci\u00f3n. Esto afecta a las versiones basadas en (o equivalentes a) la base de c\u00f3digo de la era 2016 (1.0.0)."}], "lastModified": "2026-07-22T08:10:00.117", "sourceIdentifier": "cve@mitre.org"}