Skip to content
OpenAdvisories
Medium WID-SEC-2026-2306 3 CVEs

DENX U-Boot: Mehrere Schwachstellen

Published Jul 13, 2026 · Updated Jul 13, 2026 · de-DE

Vendor: denx Product: U-Boot Platform: Linux

Summary

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in DENX U-Boot ausnutzen, um einen Denial of Service Angriff durchzuführen und beliebigen Code auszuführen.

Product

U-Boot ist ein weit verbreiteter Open-Source-Bootloader.

Vulnerabilities 3

  • High 8.2
    CVE-2026-29009

    U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK

    U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple r…

    Uboot u-boot u-boot u-boot Debian Ubuntu
  • High 7.5
    CVE-2026-29008

    U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()

    U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset …

    Uboot u-boot u-boot u-boot Debian Ubuntu
  • Medium 5.3
    CVE-2026-29007

    U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c

    U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP …

    Uboot u-boot u-boot u-boot Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References