CVE-2026-29007
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In U-Boot through 2026.04-rc3, an out-of-bounds read vulnerability exists in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled. A remote attacker can craft a malicious packet with mismatched IP total length and TCP data offset field, causing reads beyond TCP segment boundaries and potentially disrupting connection state.
Risk Assessment
An attacker can remotely disrupt the TCP stack in U-Boot, potentially leading to denial of service or destabilization of network connections.
Recommendation
Update U-Boot to a version above 2026.04-rc3 once the vendor provides a fix, or disable CONFIG_PROT_TCP if not required.
Other vulnerabilities in U-Boot
See all- CVE-2026-74221High
U-Boot before 2026.10-rc5 contains a buffer overflow in the nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
- CVE-2026-74220High
U-Boot before 2026.10-rc5 contains a buffer overflow in the nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.
- CVE-2026-71972Medium
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. An attacker can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.
- CVE-2026-71971High
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.
- CVE-2022-2347High
There exists an unchecked length field in U-Boot that can lead to memory corruption. The DFU implementation in U-Boot does not bound the length field in USB DFU download setup packets, allowing an attacker to send a packet with a length greater than 4096 bytes.
- CVE-2025-70293Critical
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.
- CVE-2025-70290Critical
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
- CVE-2026-74225High
U-Boot before 2026.10-rc5 contains an out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
- CVE-2026-74222High
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.
- CVE-2026-71974Medium
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. An attacker with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.
Original NVD description (English source)
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS