BusyBox volume_id: Integer overflow in filesystem probing leads to crash (DoS)
Summary
A flaw in the volume_id component of BusyBox allows an integer overflow when calculating buffer boundaries during filesystem metadata probing. An attacker who can present a specially crafted filesystem image on an attached storage device can crash utilities such as blkid, findfs or mount. The result is a denial of service that can prevent storage devices from being resolved or mounted. The vulnerability requires local access and user interaction, and affects only systems where BusyBox probes untrusted media.
Affected
- BusyBox versions with the volume_id component (affected version ranges not yet confirmed)
- Red Hat Hardened Images: affected (per Red Hat CVE record)
- Red Hat Enterprise Linux 6: default status unknown
- Red Hat Enterprise Linux generally uses util-linux rather than BusyBox for probing, so exposure is limited there
Fixed in
Unknown.
- No fixed release has been confirmed for this CVE.
- Related fixes exist only in upstream BusyBox master; no release containing them has been identified.
Workaround
- Do not run blkid, findfs or automatic mounting against untrusted removable media or disk images until a fixed build is available.
- Disable automatic mounting of USB or removable storage on servers and kiosks where it is not needed.
- Red Hat states that no mitigation is currently available that meets its criteria.
Exploitation
- No known exploitation in the wild.
- No public proof-of-concept found.
- Status to be re-checked against NVD and CISA KEV.
Our recommendation
- Identify systems and container or appliance images that include BusyBox and use volume_id utilities (blkid, findfs, mount).
- Restrict processing of untrusted USB or removable media on exposed systems.
- Apply vendor BusyBox updates from your distribution (Red Hat, Debian, Alpine, Ubuntu or embedded vendor) as soon as they are published.
- Re-check the Red Hat CVE page and NVD for fix details and scoring changes.
- Priority: medium for systems that accept external media or run BusyBox-based appliances; low for typical office endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-124746 access.redhat.com
- Red Hat Bugzilla 2571675 bugzilla.redhat.com
- BusyBox security research (causalsecurity) causalsecurity.com
- BusyBox mailing list patch (volume_id label length) www.mail-archive.com
- BusyBox project busybox.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:26.
Original description (NVD)
A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.