CVE-2026-29008
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Vulnerability in U-Boot up to version 2026.04-rc3 in the tcp_rx_state_machine() function in net/tcp.c. Sending a crafted TCP SYN+ACK packet with a manipulated data offset field causes an integer underflow, leading to bootloader crash and potential memory corruption.
Risk Assessment
Risk of bootloader crash preventing device boot and potential memory corruption, leading to unpredictable system behavior.
Recommendation
Update U-Boot to a patched version or apply appropriate network traffic filtering rules.
Other vulnerabilities in U-Boot
See all- CVE-2022-2347High
There exists an unchecked length field in U-Boot that can lead to memory corruption. The DFU implementation in U-Boot does not bound the length field in USB DFU download setup packets, allowing an attacker to send a packet with a length greater than 4096 bytes.
- CVE-2025-70290Critical
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
- CVE-2025-70293Low risk· EPSS 7%
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.
- CVE-2026-29009High
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets without cumulative length validation.
- CVE-2026-29007Medium
In U-Boot through 2026.04-rc3, an out-of-bounds read vulnerability exists in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled. A remote attacker can craft a malicious packet with mismatched IP total length and TCP data offset field, causing reads beyond TCP segment boundaries and potentially disrupting connection state.
- CVE-2026-36175Medium
An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.
Original NVD description (English source)
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.