Das U Boot
Monthly
Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).
Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).