Is CVE-2026-29008 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29008 being exploited in the wild.

How severe is CVE-2026-29008?

High severity, with a CVSS score of 7.5, published 8 July 2026.

Which products and versions are affected?

Das U-Boot Project U-Boot through 2026.04-rc3.

Is there a fix for CVE-2026-29008?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-29008 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-29008?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29008: U-Boot integer underflow in tcp_rx_state_machine

CVE-2026-29008 · Severity: high · CVSS 7.5 · Published 2026-07-08

U-Boot is a widely used open-source bootloader responsible for initializing hardware and starting the operating system on embedded devices. A vulnerability in its networking component allows a nearby attacker to crash the device during the boot process by sending a specially crafted network packet. This can prevent the device from starting up successfully, leading to a denial of service that may require physical intervention to recover.

Quick answers

Is CVE-2026-29008 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29008 being exploited in the wild.
How severe is CVE-2026-29008?: High severity, with a CVSS score of 7.5, published 8 July 2026.
Which products and versions are affected?: Das U-Boot Project U-Boot through 2026.04-rc3.
Is there a fix for CVE-2026-29008?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-29008 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-29008?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow exists in the tcp_rx_state_machine() function within net/tcp.c. When the bootloader is in the TCP_SYN_SENT state, it may process a malformed TCP SYN+ACK packet where a manipulated data offset field causes the payload_len calculation to result in a negative value. Because the TCP_SYN_SENT handler fails to invoke tcp_seg_in_wnd() validation, this negative value is implicitly converted to a large unsigned integer when passed to memcpy() in the store_block() function. This results in an out-of-bounds memory access and immediate crash. If CONFIG_LMB is disabled, this could potentially lead to further memory corruption. The vulnerability is exploitable by an unauthenticated attacker on the same local network segment.

Affected products

Das U-Boot Project U-Boot through 2026.04-rc3

Timeline

2026-05-08: disclosed: Initial outreach to U-Boot mailing list by VulnCheck
2026-07-08: advisory: Public advisory released by VulnCheck and NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.