# CVE-2025-70290: Denx U-Boot integer overflow in ZFS filesystem support

Source: https://junglewise.ai/threats/cve-2025-70290-denx-u-boot-integer-overflow-in-zfs-filesystem-support  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-70290 · Severity: critical · CVSS 9.8 · Published 2026-08-26

U-Boot is a bootloader used to initialize and launch embedded systems and servers. An integer overflow in its ZFS filesystem support allows an attacker to craft a malicious ZFS disk image that triggers memory corruption during the boot process, potentially causing a system crash or allowing code execution before the operating system even loads.

Technologies: [Denx U-Boot](https://junglewise.ai/threats/technologies/u-boot). Vendors: [Denx](https://junglewise.ai/threats/vendors/denx).

## Quick answers

**Is CVE-2025-70290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-70290 being exploited in the wild.

**How severe is CVE-2025-70290?** Critical severity, with a CVSS score of 9.8, published 26 August 2026.

**Which products and versions are affected?** Denx U-Boot before 2026.04.

**Is there a fix for CVE-2025-70290?** A patch was published on 2026-04: Fix available in U-Boot v2026.04-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-70290 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-70290?** Check whether you run Denx U-Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer overflow in the `zfs_nvlist_lookup_nvlist` function within `fs/zfs/zfs.c`. An attacker can supply a malformed ZFS filesystem image with specially crafted on-disk metadata that triggers an integer overflow during size calculation for a `calloc()` call. This under-allocation is followed by out-of-bounds memory access, potentially leading to heap corruption, denial of service, or arbitrary code execution in the bootloader context (pre-OS execution, typically no user interaction required). The fix uses compiler intrinsics like `__builtin_add_overflow` to safely validate allocation sizes. Patched in U-Boot v2026.04-rc1 (commit adccdb2).

## Affected products

- Denx U-Boot before 2026.04

## Timeline

- 2026-08-26: disclosed: Public disclosure via NVD and GitHub Gist
- 2026-04: patched: Fix available in U-Boot v2026.04-rc1

## References

- [http://u-boot.com/](http://u-boot.com/)
- [https://gist.github.com/c0zy1/4d9648d10a5ff07bda2771ea1298e469](https://gist.github.com/c0zy1/4d9648d10a5ff07bda2771ea1298e469)

## Related threats

- [Denx U-Boot integer overflow in ext4fs_get_bgdtable](https://junglewise.ai/threats/cve-2025-70293-denx-u-boot-integer-overflow-in-ext4fs-get-bgdtable)
- [Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and…](https://junglewise.ai/threats/cve-2025-24857-improper-access-control-for-volatile-memory-containing-boot-code)
- [Das U-Boot integer overflows in memory allocator](https://junglewise.ai/threats/cve-2024-57258-das-u-boot-integer-overflows-in-memory-allocator)
- [Das U-Boot integer overflow in ext4fs_read_symlink](https://junglewise.ai/threats/cve-2024-57256-das-u-boot-integer-overflow-in-ext4fs-read-symlink)
- [DENX U-Boot heap buffer overflow in USB DFU implementation](https://junglewise.ai/threats/cve-2022-2347-denx-u-boot-heap-buffer-overflow-in-usb-dfu-implementation)