U-Boot EUVD-2026-89429

Requires ALL of: (1) U-Boot built with CONFIG_IP_DEFRAG enabled - this is an opt-in, frequently-disabled compile option, so builds without it are not vulnerable; (2) the device actively performing a netboot (DHCP/TFTP/NFS-style network boot) so that IP fragment reassembly is exercised; (3) an attacker able to deliver a crafted IP fragment with non-zero offset and the More-Fragments flag onto the boot network path (on-path or same-segment injection during the narrow boot window). No authentication or user interaction is needed (PR:N/UI:N), but the netboot-only, config-gated, timing-dependent nature substantially limits real-world exploitability versus a persistently-listening network service.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:L/VA:H, base 8.8) describes a remote, unauthenticated, low-complexity flaw whose impact is availability-dominant (VA:H = bootloader crash) with only limited integrity impact (VI:L = adjacent memory corruption) and no confidentiality loss - consistent with CWE-787 OOB write. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is not confirmed in practice; the 8.8 is a capability score, not an exploitation-likelihood signal. The critical mitigating factor absent from the raw score is that the flaw only exists when CONFIG_IP_DEFRAG is compiled in (a non-default option in many U-Boot builds) and can only be triggered while the device is actively netbooting and processing IP fragments - a narrow, transient window. The AV:N rating is technically correct but practically means an on-path/same-segment attacker who can answer or inject during the netboot exchange, not arbitrary internet reachability. Net: a real but conditionally-triggered availability/corruption bug - treat as medium priority for fleets that actually netboot with defragmentation enabled, lower elsewhere.

During a device's network boot, an attacker on the boot network path sends a single crafted IP fragment with a non-zero fragment offset and the More-Fragments flag set. U-Boot's __net_defragment() reassembly writes a hole descriptor past the end of pkt_buff, corrupting adjacent memory and crashing the bootloader, halting or looping the boot. No public exploit code is identified; exploitation requires timing the malicious fragment to the active netboot window.