Bug 2571620 (CVE-2026-124742) - CVE-2026-124742 busybox: Divide-by-zero in the volume_id FAT prober via a zero sectors_per_cluster value
Summary: CVE-2026-124742 busybox: Divide-by-zero in the volume_id FAT prober via a zer...
Keywords:
Status: NEW
Alias: CVE-2026-124742
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2571622 2571623
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-11 09:49 UTC by OSIDB Bzimport
Modified: 2026-11-11 09:53 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-11 09:49:40 UTC 
A flaw was found in BusyBox's volume_id FAT prober. A magic string in the boot sector, such as "FAT16   ", skips the geometry checks, so a sectors_per_cluster value of 0 can be used as a divisor, causing a divide-by-zero (SIGFPE) crash. A crafted filesystem image on an attached device triggers this when probed by blkid, findfs or mount LABEL=/UUID=, which probe every device in /proc/partitions; the crash prevents those applets from resolving any device and may fail boot or hotplug scripts that rely on them.
Note You need to log in before you can comment on or make changes to this bug.