CVE-2026-29009highCWE-120

CVE-2026-29009: falha de alta gravidade em u-boot

U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar u-boot+ Monitorar u-boot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.8epss 0.7%
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
u-boot · u-boot
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — u-boot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-29008HIGHU-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()EPSS 0.7%CVE-2026-29007MEDIUMU-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.cEPSS 0.7%CVE-2026-71971HIGHU-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment ReassemblyEPSS 0.4%CVE-2026-74221HIGHU-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKEPSS 0.3%CVE-2026-74220HIGHU-Boot before 2026.10-rc5 Buffer Overflow via NFS READ ReplyEPSS 0.3%CVE-2026-74222HIGHU-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive CallbackEPSS 0.3%