Description
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
Published: 2026-07-08
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

U‑Boot releases up through 2026.04‑rc3 contain an integer underflow flaw in the tcp_rx_state_machine() routine. A network‑adjacent attacker can send a specially crafted TCP SYN+ACK packet with a manipulated data‑offset field, causing the computed payload length to become negative. The negative value is implicitly converted to a large unsigned integer (e.g., resulting in an immediate bootloader crash and, if the LMB memory model is disabled, potential memory corruption. The vulnerability is a classic signed‑to‑unsigned underflow (CWE‑191).

Affected Systems

All devices that use U‑Boot versions 2026.04‑rc3 or earlier and the TCP subsystem is compiled in, so any vendor shipping these releases with network support enabled is implicated.

Risk and Exploitability

The CVSS score of 8.7 marks this as a high‑severity flaw. EPSS is under 1 %, indicating a low probability of active exploitation, yet the attack requires only an adversary that can reach the device over the local network to transmit the crafted packet. Because the vulnerability causes an immediate crash of the bootloader, availability—and potentially device integrity if a memory corruption occurs—are severely compromised. The flaw is not listed in CISA KEV, but its high impact warrants timely remediation.

Generated by OpenCVE AI on July 26, 2026 at 17:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an updated U‑Boot release that addresses the integer.04‑rc4 or later.
  • If a firmware update cannot be performed immediately, isolate the device from the network during boot or disable its network interface so that malicious packets cannot reach the vulnerable code path.
  • Reconfigure the bootloader build to exclude the TCP subsystem by clearing CONFIG_NET or related TCP options when network functionality is not required, thereby removing the attack vector entirely.

Generated by OpenCVE AI on July 26, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Denx
Denx u-boot
CPEs cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
Vendors & Products Denx
Denx u-boot

Mon, 13 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
References

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared U-boot
U-boot u-boot
Vendors & Products U-boot
U-boot u-boot

Thu, 09 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
Title U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Denx U-boot
U-boot U-boot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-14T18:39:49.802Z

Reserved: 2026-03-03T16:42:01.012Z

Link: CVE-2026-29008

cve-icon Vulnrichment

Updated: 2026-07-09T13:55:57.735Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T17:30:17Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)