Which versions of U-Boot are affected by CVE-2026-74221?

U-Boot, the bootloader used on many embedded and appliance platforms, has a high-severity memory corruption flaw that can crash devices during NFS network boot.. A patch is available.

How to fix or mitigate CVE-2026-74221?

Within 24 hours, inventory all devices running U-Boot versions before 2026.10-rc5 and identify which actively netboot over NFS; restrict access to trusted NFS servers and monitor boot traffic. Within 7 days, apply the vendor-released patch 2026.10-rc5 or later to affected devices, or if emergency change is not possible, disable NFS netboot or isolate the boot network. Within 30 days, complete firmware upgrades across the fleet, verify U-Boot versions are at or above 2026.10-rc5, and update configuration standards to prevent NFS boot from untrusted servers.

U-Boot CVE-2026-74221

Q: What is the CVSS score of CVE-2026-74221?

CVE-2026-74221 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-89434 HIGH

Signed to Unsigned Conversion Error (CWE-195)

2026-09-29 VulnCheck

GHSA-r9ch-9wx4-f978

Buffer Overflow Suse U Boot

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Malicious NFS server reply reaches an unauthenticated client parser over the network (AV:N/AC:L/PR:N/UI:N); impact is bootloader crash (A:H) with limited memory corruption (I:L) and no disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 29, 2026 - 22:07 vuln.today

CVE Published

Sep 29, 2026 - 21:29 cve.org

HIGH 8.8

DescriptionCVE.org

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

AnalysisAI

Memory corruption in U-Boot’s NFS READLINK handling can crash the bootloader on devices booting over NFS. A malicious or man-in-the-middle NFS server can return a crafted symlink length that triggers a signed-to-unsigned conversion error (CWE-195) and out-of-bounds access in nfs_readlink_reply(), affecting U-Boot versions before 2026.10-rc5; the vendor CVSS 4.0 base score is 8.8. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the U-Boot device to be configured for and actively performing an NFS netboot (the NFS client code path), and the attacker must control the NFS server or hold a man-in-the-middle position on the boot network so it can return a crafted READLINK reply with a negative or oversized symlink length. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H, base 8.8) frames this as a network-reachable, low-complexity, unauthenticated flaw whose dominant impact is availability (VA:H crash of the bootloader) with only limited integrity impact (VI:L memory corruption) and no confidentiality loss (VC:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: 2026.10-rc5 or later; the upstream fix is commit 1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd and the vendor advisory is at https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-readlink. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all devices running U-Boot versions before 2026.10-rc5 and identify which actively netboot over NFS; restrict access to trusted NFS servers and monitor boot traffic. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in U Boot

View all

CVE-2022-34835 CRITICAL Act Now POC

9.8 Jun 30

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md"

CVE-2022-30790 HIGH Act Now POC

7.8 Jun 08

Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. Rated high severity (CVSS 7.8), this vu

CVE-2020-10648 HIGH Act Now POC

7.8 Mar 19

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images

CVE-2022-30767 CRITICAL Act Now POC

9.8 May 16

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fai

CVE-2018-18439 CRITICAL Act Now POC

9.8 Nov 20

DENX U-Boot through 2018.09-rc1 has a remotely exploitable buffer overflow via a malicious TFTP server because TFTP traf

CVE-2022-2347 HIGH Act Now POC

7.7 Sep 23

There exists an unchecked length field in UBoot. Rated high severity (CVSS 7.7), this vulnerability is no authentication

CVE-2019-14199 CRITICAL Emergency

9.8 Jul 31