Description
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| u-boot | u-boot | < 2026.10-rc5 | 2026.10-rc5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | u-boot | No fix yet | — |
| Debian 13 | u-boot | No fix yet | — |
| Debian 12 | u-boot | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | u-boot | 2025.10-0ubuntu6 | USN-8930-2 |
| Ubuntu 26.04 LTS | u-boot | 2025.10-0ubuntu2.2 | USN-8930-1 |
| Ubuntu 24.04 LTS | u-boot | 2025.10-0ubuntu0.24.04.4 | USN-8930-1 |
| Ubuntu 24.04 LTS | u-boot-nezha | No fix yet | — |
| Ubuntu 22.04 LTS | u-boot | 2022.01+dfsg-2ubuntu2.9 | USN-8930-1 |
| Ubuntu 22.04 LTS | u-boot-nezha | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | u-boot | 2021.01+dfsg-3ubuntu0~20.04.6+esm2 | USN-8930-1 |
| Ubuntu Pro 18.04 LTS | u-boot | 2020.10+dfsg-1ubuntu0~18.04.3+esm2 | USN-8930-1 |
| Ubuntu Pro 16.04 LTS | u-boot | 2016.01+dfsg1-2ubuntu5+esm2 | USN-8930-1 |
Advisories 3
- USN-8930-2 u-boot vulnerabilities Ubuntu Security Notices (USN) · Oct 21, 2026
- WID-SEC-2026-3660 DENX U-Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- USN-8930-1 u-boot vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
References
- https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076 patch
- https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304 technical-description
- https://github.com/u-boot/u-boot product
- VulnCheck Advisory: U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6 third-party-advisory