Summary
Timo Preißl discovered that U-Boot incorrectly handled certain malformed
ZFS file system metadata. An attacker could possibly use this issue to
trigger an integer overflow and out-of-bounds memory access, resulting in
arbitrary code execution or a denial of service. (CVE-2025-70290)
Timo Preißl discovered that U-Boot incorrectly calculated buffer sizes when
processing certain ext4 file systems. An attacker could possibly use this
issue to trigger an integer overflow and out-of-bounds memory access,
resulting in arbitrary code execution or a denial of service. This issue
only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2025-70293)
Mateusz Furdyna discovered that U-Boot incorrectly handled certain
fragmented IP traffic when IP defragmentation was enabled. An attacker
could possibly use this issue to corrupt memory by sending crafted IP
fragments, resulting in arbitrary code execution. (CVE-2026-15390)
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly
handled certain fragmented IP traffic during network boot when IP
defragmentation was enabled. An attacker could possibly use this issue to
trigger an out-of-bounds write, resulting in a denial of service.
(CVE-2026-71971)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | u-boot | 2022.01+dfsg-2ubuntu2.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | u-boot | 2025.10-0ubuntu0.24.04.3 |
| Ubuntu · 26.04 LTS 26.04:LTS | u-boot | 2025.10-0ubuntu2.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | u-boot | 2016.01+dfsg1-2ubuntu5+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | u-boot | 2020.10+dfsg-1ubuntu0~18.04.3+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | u-boot | 2021.01+dfsg-3ubuntu0~20.04.6+esm1 |
Vulnerabilities 4
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support …
-
Critical 9.8
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_…
-
Critical 9.0
Out-of-bounds write in Das U-Boot
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was f…
-
High 8.2
U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netb…