Das U-Boot CVE-2025-70293

Upstream fix available (commit adccdb2); update to U-Boot 2026.04 or later, which contains the corrected ext4fs_get_bgdtable() size handling - rebuild and reflash the bootloader for all affected device images (note that flashing a bootloader carries bricking risk and typically requires a maintenance/recovery path). Because bootloaders are vendor-integrated, also track your SoC/board vendor's BSP release incorporating the fix. As compensating controls where reflashing is not immediately feasible: restrict physical access to boot media and disable booting from untrusted removable media (USB/SD) in the boot configuration, which prevents attacker-supplied ext4 images but may break legitimate field-update workflows; if the ext4 driver is not required, build U-Boot without CONFIG_FS_EXT4 to remove the vulnerable code path entirely, at the cost of losing ext4 boot support; and enforce verified/secure boot with signed images so a tampered filesystem is rejected before parsing where the platform supports it. Reference advisory: https://seclists.org/oss-sec/2026/q3/607.