Das U-Boot CVE-2026-15390

Requires the U-Boot image to be compiled with the non-default CONFIG_IP_DEFRAG=y option, and the device to be actively using U-Boot's network stack (e.g. TFTP/PXE netboot) so that the IP reassembly path processes attacker fragments. The attacker must be on the adjacent L2 network segment (AV:A) to deliver fragmented IP traffic and the duplicated last-fragment packets, and must hit the narrow boot-time window when the bootloader is running. AT:P reflects the timing/duplication precondition against uncleared reassembly state. No authentication or user interaction is required (PR:N/UI:N), but the compile-time flag, adjacent access, and boot-window timing are the practical limiting factors.

This is a genuinely high-severity issue on the merits: CWE-787 out-of-bounds write leading to arbitrary code execution in a bootloader, where code execution means total control below the OS with no privilege boundary to contain it. However, the CVSS 4.0 vector materially constrains real-world risk in two ways that the headline 9.0 obscures. First, AV:A (adjacent) - not AV:N - means the attacker must be on the same L2 network segment to deliver the fragmented IP traffic; this is not internet-wide exploitation. Second, AT:P (attack requirements present) reflects the race-like precondition of delivering duplicated last-fragment packets against uncleared reassembly state, which raises practical exploitation difficulty (mapping to AC:H in 3.1 terms). There is also a critical exposure-window limit not captured in any score: U-Boot's IP stack is only active during the boot/network-boot phase (TFTP/PXE), so the device must be booting and processing IP fragments at the moment of attack. No EPSS score, no CISA KEV listing, and no public POC were provided - so this is 'no public exploit identified at time of analysis.' Net: a real and serious flaw warranting patching on affected embedded fleets, but the adjacent-only vector, non-default CONFIG_IP_DEFRAG requirement, timing-dependent trigger, and narrow boot-time window make widespread opportunistic exploitation unlikely; prioritize where netbooting embedded devices sit on untrusted or shared L2 networks.

An attacker on the same local network segment as an embedded device that netboots (TFTP/PXE) with a U-Boot build compiled with CONFIG_IP_DEFRAG=y waits for or forces a boot cycle, then sends a stream of fragmented IP packets followed by duplicated last-fragment packets. Because U-Boot never clears its IP reassembly state after delivering a complete datagram, the duplicate triggers an out-of-bounds write that is groomed into arbitrary code execution in the bootloader. No public exploit code was identified at time of analysis; the flaw was reported by CERT-PL and fixed by DENX.