U‑Boot releases before 2026.07‑rc2 contain a stack buffer overflow in the nfs_readlink_reply() function. When NFS support is enabled, an attacker can trick the bootloader into receiving multiple READLINK responses each containing large relative symlink targets. These targets are concatenated into a 2048‑byte buffer without cumulative length checks, overflow the buffer, and corrupt adjacent BSS variables such as nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id. The result is memory corruption that can disrupt the NFS client state machine or alter the bootloader’s control flow, potentially leading to denial of service or unpredictable device behavior.

All U‑Boot builds that include the CONFIG_CMD_NFS option and were released before 2026.07‑rc2 are affected. Devices that ship with a firmware image containing this configuration and have reachable NFS servers are vulnerable unless the firmware is updated to a patched release. Hardware vendors that rely on this version or earlier must verify that their images contain the fix before deployment.

The vulnerability receives a CVSS score of 8.8, signalling high severity. The EPSS score is below 1%, indicating a low probability of current exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote TCP traffic from an NFS server that the device communicates with; no authentication is required in the protocol, so the threat is external. Upon delivery of crafted READLINK responses, the attacker can overwrite critical bootloader variables, thereby causing memory corruption that may lead to denial of service or give the attacker influence over the boot process.