Zephyr RTOS CVE-2026-13215

Exploitation requires physical or supply-chain access to the target device sufficient to present a crafted ext2-formatted storage medium - for example, inserting a malicious SD card or USB mass storage device, or preloading a malicious embedded flash image. The Zephyr firmware must be compiled with CONFIG_FILE_SYSTEM_EXT2=y (not enabled in all builds) and the application must perform a mount operation on the attacker-supplied medium, either automatically on media insertion or through an application trigger. No authentication credential or software privilege is required beyond physical device access. Exploitation is bounded by: (1) AV:P - requires physical proximity or supply-chain position; (2) the ext2 driver must be compiled into the firmware, which is not universal across Zephyr deployments; (3) the device must attempt to mount the medium, which depends on application behavior. Remote network exploitation is not possible given the physical attack vector.

The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 6.8) accurately reflects the physical attack vector, which is the primary constraint on real-world risk: an adversary must physically insert a crafted storage medium into the target device. This limits the threat population to supply-chain actors, insiders, or individuals with brief physical device access, substantially reducing the exploitable population compared to network-reachable vulnerabilities. No EPSS data was provided, and the vulnerability does not appear in CISA KEV, indicating no confirmed widespread active exploitation. No public POC code is identified. Despite these constraints, the consequence of exploitation is severe: Zephyr runs on microcontrollers and embedded devices that typically lack ASLR, stack canaries, and other memory-safety mitigations common in general-purpose operating systems, meaning supervisor-mode memory corruption is more directly convertible to code execution. The wildcard NVD CPE (all Zephyr versions) means the specific affected and patched release boundaries must be confirmed against GHSA-j52j-gfj9-rwjm. The CVSS score of 6.8 is appropriate given the physical access requirement; this is not a high-priority internet-facing risk but represents a meaningful hardware supply-chain or physical-access threat for Zephyr-based devices that mount untrusted media.

An attacker with brief physical access to a Zephyr-based embedded device inserts a crafted SD card whose ext2 superblock contains a manipulated s_log_block_size value (for example, 0xFFFFFFFF or any value producing a block size exceeding CONFIG_EXT2_MAX_BLOCK_SIZE). When the device mounts the medium - automatically on insertion or via an application - the kernel-mode ext2 driver passes the inflated block size to k_mem_slab_init(), silently misconfiguring the slab beyond its static backing buffer, and the first block read immediately overwrites adjacent static memory in supervisor mode. Depending on the Zephyr memory layout of the specific firmware build, this write could corrupt function pointers, security state, or task control structures, potentially enabling code execution in supervisor mode; no public POC code has been identified at time of analysis.