A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 filesystem image that results in a zero logical block size. The vulnerability is triggered during mount or image processing and leads to a Floating-Point Exception (FPE) under sanitizers or a runtime crash in standard builds due to missing validation of lb_size.
References
| Link | Resource |
|---|---|
| https://github.com/gkostka/lwext4/issues/90 | Exploit Issue Tracking Patch |
| https://github.com/sigdevel/pocs/blob/main/res/lwext4/2/sig8_2_lwext4_ext4_blockdev_c_127 | Exploit |
| https://infosec.exchange/@sigdevel/116668952003072580 | Exploit Patch Third Party Advisory |
| https://github.com/gkostka/lwext4/issues/90 | Exploit Issue Tracking Patch |
Configurations
History
05 Jun 2026, 21:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gkostka
Gkostka lwext4 |
|
| References | () https://github.com/gkostka/lwext4/issues/90 - Exploit, Issue Tracking, Patch | |
| References | () https://github.com/sigdevel/pocs/blob/main/res/lwext4/2/sig8_2_lwext4_ext4_blockdev_c_127 - Exploit | |
| References | () https://infosec.exchange/@sigdevel/116668952003072580 - Exploit, Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:gkostka:lwext4:1.0.0:*:*:*:*:*:*:* |
03 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-369 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| References | () https://github.com/gkostka/lwext4/issues/90 - |
03 Jun 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-03 14:16
Updated : 2026-06-05 21:09
NVD link : CVE-2025-70100
Mitre link : CVE-2025-70100
CVE.ORG link : CVE-2025-70100
JSON object : View
Products Affected
gkostka
- lwext4
CWE
CWE-369
Divide By Zero