BUSYBOX · CVE-2026-124746 · Infrastructure
NO FIX YET
An integer overflow in BusyBox's volume_id code, used when probing filesystem metadata, can be triggered by a specially crafted filesystem image on an attached storage device. Successful exploitation crashes utilities such as blkid, findfs or mount, denying service by preventing storage devices from being resolved or mounted.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run BusyBox utilities blkid, findfs or mount and that mount or probe storage devices that could carry untrusted filesystem images, such as removable media or attached disks. Systems that do not probe untrusted storage, or that use other implementations of these tools, can likely skip it. The sources do not give affected version ranges.
Not affected if glibc-utilities-only, no-untrusted-storage
Who cares busybox, embedded-linux, linux
busybox --help or busybox | head -1 on systems that ship it.blkid, findfs or mount on the system are provided by BusyBox (for example ls -l $(which blkid)).No fix yet, per the sources.
A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.