Executive brief
U-Boot is an open-source bootloader used to initialize hardware and start the operating system on various devices. A vulnerability in its network file sharing (NFS) component allows a malicious or compromised server to crash the device or take control of its network state during the boot process. This could lead to a complete denial of service or allow an attacker to redirect the device's network traffic.
Technical details
A classic buffer overflow (CWE-120) exists in the nfs_readlink_reply() function within net/nfs-common.c. The vulnerability occurs because the code fails to perform cumulative length validation when appending multiple relative symlink targets to the 2048-byte nfs_path_buff buffer. An attacker controlling an NFS server can send multiple READLINK responses (e.g., two responses of ~1100 bytes each) to overflow the buffer and corrupt adjacent BSS variables such as nfs_server_ip, nfs_server_port, and rpc_id. This allows for memory corruption and potential manipulation of the NFS client state machine. The issue is present in versions up to 2026.04-rc3 when the NFS command is enabled.
Affected products
- u-boot project U-Boot through 2026.04-rc3
Timeline
- 2026-05-08: other: Coordinated disclosure process initiated by VulnCheck
- 2026-07-08: advisory: CVE-2026-29009 published