Executive brief
U-Boot is an open-source bootloader used to initialize hardware and start the operating system on various devices. A flaw in its networking component allows a remote attacker to send specially crafted network packets that cause the system to read memory outside of the intended area. This can lead to the corruption of internal connection settings, potentially causing network communication failures or system instability during the boot process.
Technical details
An out-of-bounds read vulnerability exists in the `tcp_rx_state_machine()` function within `net/tcp.c` when `CONFIG_PROT_TCP` is enabled. The flaw is triggered by a mismatch between the IP total length and the TCP data offset field in a received packet. Specifically, an attacker can send a packet with a small IP total length (e.g., 40 bytes) but a larger TCP data offset (e.g., 60 bytes), causing `tcp_parse_options()` to read memory beyond the actual TCP segment. This can result in the corruption of connection state variables such as `rmt_win_scale` and `rmt_timestamp`, leading to a denial of service or disruption of TCP window calculations. The vulnerability is reachable over the network without authentication.
Affected products
- Das U-Boot project U-Boot through 2026.04-rc3
Timeline
- 2026-05-08: disclosed: Initial outreach to U-Boot mailing list by VulnCheck
- 2026-07-08: advisory: CVE-2026-29007 published by NVD and VulnCheck