Which versions of Das U-Boot are affected by CVE-2026-29009?

Das U-Boot bootloader contains a buffer overflow vulnerability (CVE-2026-29009, CVSS 8.8) in NFS client functionality triggered by a compromised NFS server; no public exploit identified at time of…

How to fix or mitigate CVE-2026-29009?

24 hours: Identify all systems running U-Boot with CONFIG_CMD_NFS enabled, particularly those using NFS boot. 7 days: Restrict NFS server access to trusted networks only, implement network segmentation isolating NFS infrastructure, and audit NFS server security controls. 30 days: Monitor vendor advisories for Das U-Boot patch release; when available, prioritize testing and deployment of patched U-Boot version.

Das U-Boot CVE-2026-29009

Q: What is the CVSS score of CVE-2026-29009?

CVE-2026-29009 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42333 HIGH

Classic Buffer Overflow (CWE-120)

2026-07-08 VulnCheck

GHSA-rqrq-75p3-gc68

Buffer Overflow U Boot

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable via a malicious/compromised NFS server with no auth (PR:N) and simple crafted responses (AC:L); memory corruption yields high availability impact and limited integrity, no disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 17:00 vuln.today

DescriptionCVE.org

U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

AnalysisAI

Server-controlled buffer overflow in Das U-Boot (bootloader) through 2026.04-rc3 lets a malicious or compromised NFS server corrupt memory in an U-Boot client built with CONFIG_CMD_NFS. The flaw lives in nfs_readlink_reply() (net/nfs-common.c), where relative symlink targets from consecutive READLINK responses are appended to the fixed 2048-byte nfs_path_buff without cumulative length checks; two responses of ~1100 bytes each overflow it and clobber adjacent BSS state (nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, rpc_id), giving control over the NFS client state machine. Reported by VulnCheck with a CVSS 4.0 base score of 8.8; there is no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

U-Boot is the de-facto bootloader for embedded/IoT and many SoC-based systems, and it can fetch boot artifacts over the network via its optional NFS client (enabled with CONFIG_CMD_NFS). The bug is a classic CWE-120 classic buffer overflow (unbounded copy) in the NFS READLINK reply handler: nfs_path_buff is a fixed 2048-byte buffer in the BSS, and when a symlink target is relative, U-Boot appends the returned path fragment to what is already in the buffer. Because the handler validates neither the per-response length nor the running cumulative total, a server that returns multiple relative symlink targets (~1100 bytes each) writes past the buffer end into the surrounding statically allocated globals. The corrupted neighbors are precisely the variables that drive the NFS client (server IP, mount/RPC ports, local port, protocol state, and RPC transaction id), so the overflow does not merely crash - it hands the attacker influence over the client's control state. The CPE cpe:2.3:a:u-boot:u-boot:*:*:*:*:*:*:*:* confirms the U-Boot codebase itself as the affected component rather than any single downstream distribution.

RemediationAI

No specific vendor-released patched version was provided in the input, and the fix reference points to the U-Boot developer mailing list rather than a tagged release, so this is best characterized as an upstream fix discussed/available on the mailing list (https://lists.denx.de/pipermail/u-boot/2026-May/617853.html) with a released patched version not independently confirmed; track the u-boot.org release notes and the VulnCheck advisory (https://www.vulncheck.com/advisories/u-boot-rc3-buffer-overflow-in-nfs-readlink-reply-via-nfs-readlink) for the tagged build that adds cumulative-length validation in nfs_readlink_reply(), then rebuild and reflash affected firmware. Where you cannot immediately patch, the most direct compensating control is to disable CONFIG_CMD_NFS and rebuild U-Boot if NFS boot is not required (side effect: removes network NFS boot capability entirely); if NFS boot is needed, restrict U-Boot to fetching only from trusted, hardened NFS servers on an isolated, out-of-band provisioning network, prevent devices from resolving/reaching arbitrary NFS servers, and protect that segment against ARP/DNS/route spoofing and MITM (side effect: added network segmentation and provisioning-workflow overhead). Avoid exposing NFS-boot devices to untrusted networks during boot.

More in U Boot

View all

CVE-2022-34835 CRITICAL Act Now POC

9.8 Jun 30

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md"

CVE-2022-30790 HIGH Act Now POC

7.8 Jun 08

Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. Rated high severity (CVSS 7.8), this vu

CVE-2020-10648 HIGH Act Now POC

7.8 Mar 19

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images

CVE-2022-30767 CRITICAL Act Now POC

9.8 May 16

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fai

CVE-2018-18439 CRITICAL Act Now POC

9.8 Nov 20

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traf

CVE-2022-2347 HIGH Act Now POC

7.7 Sep 23

There exists an unchecked length field in UBoot. Rated high severity (CVSS 7.7), this vulnerability is no authentication

CVE-2019-14199 CRITICAL Emergency

9.8 Jul 31