Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-29008: U-Boot can crash when receiving crafted TCP packet

CVE-2026-29008 · published 3 months ago

Summary

Versions of U-Boot up to 2026.04-rc3 may stop working if an attacker on the same network sends a specially formed TCP reply. The malformed packet triggers a calculation error that leads to a crash, preventing the device from booting. Update U-Boot to a version that includes the fix or apply the vendor’s patch to avoid the problem.

What to do

Update denx u-boot to version 2026.04 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:14	debian	u-boot	All versions
–	u-boot	u-boot	<= 2026.04-rc3
Debian:11	debian	u-boot	All versions
Debian:12	debian	u-boot	All versions
Debian:13	debian	u-boot	All versions
–	denx	u-boot	< 2026.04 2026.04 `cpe:2.3:a:denx:u-boot::::::::`
Ubuntu:Pro:16.04:LTS	canonical	u-boot	All versions
Ubuntu:22.04:LTS	canonical	u-boot-nezha	All versions

Original advisory text

U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29008... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-29008 Vendor Advisory
https://github.com/u-boot/u-boot Product
https://u-boot.org/ URL
https://www.vulncheck.com/advisories/u-boot-rc3-integer-underflow-dos-via-tcp-rx... Vendor Advisory
https://lists.denx.de/pipermail/u-boot/2026-May/617853.html Third Party Advisory
https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/ Exploit
https://security-tracker.debian.org/tracker/CVE-2026-29008 Vendor Advisory
https://ubuntu.com/security/CVE-2026-29008 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-29008 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-191Integer Underflow (Wrap or Wraparound)

Timeline

Published8 Jul 2026

Updated4 Nov 2026

First seen8 Jul 2026

Sources

CVE-2026-29008 · NVD

CVE-2026-29008 · MITRE

DEBIAN-CVE-2026-29008 · OSV

UBUNTU-CVE-2026-29008 · OSV

CVE-2026-29008 · OSV

Track software like this

Free during beta