Quick answers
- Is CVE-2025-70290 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-70290 being exploited in the wild.
- How severe is CVE-2025-70290?
- Critical severity, with a CVSS score of 9.8, published 26 August 2026.
- Which products and versions are affected?
- Denx U-Boot before 2026.04.
- Is there a fix for CVE-2025-70290?
- A patch was published on 2026-04: Fix available in U-Boot v2026.04-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-70290 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2025-70290?
- Check whether you run Denx U-Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an integer overflow in the `zfs_nvlist_lookup_nvlist` function within `fs/zfs/zfs.c`. An attacker can supply a malformed ZFS filesystem image with specially crafted on-disk metadata that triggers an integer overflow during size calculation for a `calloc()` call. This under-allocation is followed by out-of-bounds memory access, potentially leading to heap corruption, denial of service, or arbitrary code execution in the bootloader context (pre-OS execution, typically no user interaction required). The fix uses compiler intrinsics like `__builtin_add_overflow` to safely validate allocation sizes. Patched in U-Boot v2026.04-rc1 (commit adccdb2).
Affected products
- Denx U-Boot before 2026.04
Timeline
- 2026-08-26: disclosed: Public disclosure via NVD and GitHub Gist
- 2026-04: patched: Fix available in U-Boot v2026.04-rc1