# CVE-2026-29009: U-Boot buffer overflow in nfs_readlink_reply

Source: https://junglewise.ai/threats/cve-2026-29009-u-boot-buffer-overflow-in-nfs-readlink-reply  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-29009 · Severity: high · CVSS 8.2 · Published 2026-07-08

U-Boot is an open-source bootloader used to initialize hardware and start the operating system on various devices. A vulnerability in its network file sharing (NFS) component allows a malicious or compromised server to crash the device or take control of its network state during the boot process. This could lead to a complete denial of service or allow an attacker to redirect the device's network traffic.

## Quick answers

**Is CVE-2026-29009 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29009 being exploited in the wild.

**How severe is CVE-2026-29009?** High severity, with a CVSS score of 8.2, published 8 July 2026.

**Which products and versions are affected?** u-boot project U-Boot through 2026.04-rc3.

**Is there a fix for CVE-2026-29009?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-29009 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-29009?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow (CWE-120) exists in the nfs_readlink_reply() function within net/nfs-common.c. The vulnerability occurs because the code fails to perform cumulative length validation when appending multiple relative symlink targets to the 2048-byte nfs_path_buff buffer. An attacker controlling an NFS server can send multiple READLINK responses (e.g., two responses of ~1100 bytes each) to overflow the buffer and corrupt adjacent BSS variables such as nfs_server_ip, nfs_server_port, and rpc_id. This allows for memory corruption and potential manipulation of the NFS client state machine. The issue is present in versions up to 2026.04-rc3 when the NFS command is enabled.

## Affected products

- u-boot project U-Boot through 2026.04-rc3

## Timeline

- 2026-05-08: other: Coordinated disclosure process initiated by VulnCheck
- 2026-07-08: advisory: CVE-2026-29009 published

## References

- [https://lists.denx.de/pipermail/u-boot/2026-May/617853.html](https://lists.denx.de/pipermail/u-boot/2026-May/617853.html)
- [https://u-boot.org/](https://u-boot.org/)
- [https://www.vulncheck.com/advisories/u-boot-rc3-buffer-overflow-in-nfs-readlink-reply-via-nfs-readlink](https://www.vulncheck.com/advisories/u-boot-rc3-buffer-overflow-in-nfs-readlink-reply-via-nfs-readlink)