CVE-2026-29007
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In U-Boot through 2026.04-rc3, an out-of-bounds read vulnerability exists in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled. A remote attacker can craft a malicious packet with mismatched IP total length and TCP data offset field, causing reads beyond TCP segment boundaries and potentially disrupting connection state.
Risk Assessment
An attacker can remotely disrupt the TCP stack in U-Boot, potentially leading to denial of service or destabilization of network connections.
Recommendation
Update U-Boot to a version above 2026.04-rc3 once the vendor provides a fix, or disable CONFIG_PROT_TCP if not required.
Other vulnerabilities in U-Boot
See all- CVE-2022-2347High
There exists an unchecked length field in U-Boot that can lead to memory corruption. The DFU implementation in U-Boot does not bound the length field in USB DFU download setup packets, allowing an attacker to send a packet with a length greater than 4096 bytes.
- CVE-2025-70290Critical
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
- CVE-2025-70293Low risk· EPSS 7%
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.
- CVE-2026-29009High
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets without cumulative length validation.
- CVE-2026-29008High
Vulnerability in U-Boot up to version 2026.04-rc3 in the tcp_rx_state_machine() function in net/tcp.c. Sending a crafted TCP SYN+ACK packet with a manipulated data offset field causes an integer underflow, leading to bootloader crash and potential memory corruption.
- CVE-2026-36175Medium
An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.
Original NVD description (English source)
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.