U-Boot CVE-2026-74222

Exploitation requires that the U-Boot device is actively performing an HTTP download through the lwIP wget implementation (typically during netboot/provisioning) - the bug lives in a receive callback that only runs during an in-progress transfer, so there is no persistently listening service. The attacker must control the HTTP server the device fetches from, or MITM that connection, and must drive the 'HTTP data storage fails' path (e.g., a response the client cannot store) to reach the mis-returned ERR_BUF and the subsequent use of the freed PCB. Limiting factors: requires the lwIP-based wget network stack to be built in and in use, a netboot/HTTP-fetch operation in progress, and attacker control over the served content or path; impact is limited to a bootloader crash (failed/interrupted boot), not code execution or data exposure.

The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VA:H, VI:L, VC:N) scores 8.8 and correctly frames this as an availability-dominant memory-corruption bug: a use-after-free in U-Boot's lwIP wget receive callback that crashes the bootloader. The realistic risk, however, is narrower than the raw score suggests. There is no CISA KEV listing, no public exploit code, and no EPSS signal was provided - so exploitation status is 'no public exploit identified at time of analysis.' Critically, the network vector is only reachable while the device is actively performing an HTTP download via lwIP wget (i.e., during netboot/provisioning), and the freed-PCB path is only entered when 'HTTP data storage fails' - so the attacker must be the HTTP server the device is fetching from, or a MITM on that path, and must induce the storage-failure condition. This is a client-side, transient-window flaw rather than an always-listening remote service, which meaningfully reduces exposure despite the AV:N/PR:N metrics. The impact is a bootloader crash (denial of service / failed boot), not code execution or data disclosure, so the VI:L integrity metric is generous - this is best characterized as availability-only. Overall: a legitimate, patch-worthy defect with a clean vendor fix, but a targeted/opportunistic risk tied to netboot environments rather than a broadly automatable internet-facing threat.

A device running U-Boot before 2026.10-rc5 initiates an HTTP download over lwIP wget during netboot. An attacker controlling the HTTP server (or positioned as a MITM) sends a response crafted so that the client's data-storage step fails; the httpc_recv_cb() callback then frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, and lwIP's TCP input path dereferences the freed PCB, crashing the bootloader. No public exploit code is known, and the attack window is limited to the moment the device is fetching over HTTP.