# CVE-2026-71971: U-Boot out-of-bounds write in IP defragmentation

Source: https://junglewise.ai/threats/cve-2026-71971-u-boot-before-2026-10-rc3-with-config-ip-defrag-enabled-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-71971 · Severity: high · CVSS 8.2 · Published 2026-09-29

U-Boot is a bootloader that initializes embedded systems and loads the operating system. During network boot operations, a remote attacker can send a specially crafted IP packet fragment to trigger an out-of-bounds write in the defragmentation logic, corrupting memory and crashing the device before it boots. This affects devices using U-Boot with IP defragmentation enabled, blocking legitimate boot operations.

Technologies: [Das U-Boot U-Boot](https://junglewise.ai/threats/technologies/das-u-boot-u-boot). Vendors: [Das U-Boot](https://junglewise.ai/threats/vendors/das-u-boot).

## Quick answers

**Is CVE-2026-71971 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71971 being exploited in the wild.

**How severe is CVE-2026-71971?** High severity, with a CVSS score of 8.2, published 29 September 2026.

**Which products and versions are affected?** Das U-Boot U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled.

**Is there a fix for CVE-2026-71971?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71971 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-71971?** Check whether you run Das U-Boot U-Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds write in the __net_defragment() function in net/net.c, triggered when processing IP fragments with a non-zero offset and the More-Fragments flag set. An unauthenticated remote attacker on the network can send a malicious fragment during netboot to write beyond allocated buffer boundaries, corrupting adjacent memory and causing a crash. A patch is available in U-Boot 2026.10-rc3 and later.

## Affected products

- Das U-Boot U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled

## Timeline

- 2026-09-29: disclosed

## References

- [https://github.com/u-boot/u-boot](https://github.com/u-boot/u-boot)
- [https://github.com/u-boot/u-boot/blob/v2026.07/net/net.c](https://github.com/u-boot/u-boot/blob/v2026.07/net/net.c)

## Related threats

- [U-Boot out-of-bounds memory access in DHCPv6 option parsing](https://junglewise.ai/threats/cve-2026-74225-u-boot-before-2026-10-rc5-contains-out-of-bounds-memory-access-in)
- [U-Boot buffer overflow in nfs_readlink_reply](https://junglewise.ai/threats/cve-2026-74221-u-boot-before-2026-10-rc5-contains-a-buffer-overflow-in-nfs)
- [U-Boot buffer overflow in NFS read reply handling](https://junglewise.ai/threats/cve-2026-74220-u-boot-before-2026-10-rc5-contains-a-buffer-overflow-in-nfs-read)
- [U-Boot integer overflow in SquashFS directory table parsing](https://junglewise.ai/threats/cve-2026-71973-u-boot-before-2026-10-rc4-contains-an-integer-overflow)