Executive brief
U-Boot is a bootloader used to initialize and launch embedded systems and servers. An integer overflow in its ZFS filesystem support allows an attacker to craft a malicious ZFS disk image that triggers memory corruption during the boot process, potentially causing a system crash or allowing code execution before the operating system even loads.
Technical details
The vulnerability is an integer overflow in the `zfs_nvlist_lookup_nvlist` function within `fs/zfs/zfs.c`. An attacker can supply a malformed ZFS filesystem image with specially crafted on-disk metadata that triggers an integer overflow during size calculation for a `calloc()` call. This under-allocation is followed by out-of-bounds memory access, potentially leading to heap corruption, denial of service, or arbitrary code execution in the bootloader context (pre-OS execution, typically no user interaction required). The fix uses compiler intrinsics like `__builtin_add_overflow` to safely validate allocation sizes. Patched in U-Boot v2026.04-rc1 (commit adccdb2).
Affected products
- Denx U-Boot before 2026.04
Timeline
- 2026-08-26: disclosed: Public disclosure via NVD and GitHub Gist
- 2026-04: patched: Fix available in U-Boot v2026.04-rc1