Das U-Boot (CONFIG_IP_DEFRAG=y) contains an out-of-bounds write that occurs when it fails to reset the IP reassembly state after a complete datagram is processed. An attacker that can send fragmented IPv4 traffic can exploit this flaw by delivering duplicate last-fragment packets, causing the kernel to execute arbitrary code. The weakness is a classic buffer overflow and an out-of-bounds write, matching CWE-459 and CWE-787.

The vulnerability affects all versions of Das U-Boot running with the CONFIG_IP_DEFRAG option enabled, prior to the commit that introduced the fix in version 2026.07. Products from DENX Software Engineering that incorporate those U-Boot releases are impacted.

The CVSS base score of nine classifies the flaw as critical. The EPSS score is not available, but the lack of a KEV listing does not diminish the need for remediation. Exploitation requires the attacker to be able to insert fragmented IP packets toward the device, which is feasible in environments where the device is exposed to untrusted networks or where internal traffic can be controlled. Once the duplicated fragment is processed, the out-of-bounds write allows code execution with the privileges of the U-Boot process.