U‑Boot releases before 2026.07‑rc2 contain a critical stack buffer overflow in the nfs_readlink_reply() function located in net/nfs-common.c. When the CONFIG_CMD_NFS option is enabled, a malicious or compromised NFS server can trigger the overflow by returning multiple READLINK responses, each with a relative symlink target of roughly 1100 bytes. The targets are concatenated into a 2048‑byte nfs_path_buff buffer without cumulative length validation, which corrupts nearby BSS variables such as nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id. This memory corruption can disrupt the NFS client state machine or give an attacker control over the bootloader’s flow, potentially causing denial of service or unpredictable device behavior.

All U‑Boot builds that include the CONFIG_CMD_NFS option and were released before 2026.07‑rc2 are affected. Devices that ship with a firmware image containing this configuration and have reachable NFS servers are vulnerable unless the firmware is updated to a patched release. Hardware vendors that rely on this version or earlier must verify that their images contain the fix before deployment.

The vulnerability receives a CVSS score of 8.8, signalling high severity. The EPSS score is below 1%, indicating a low probability of current exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is remote TCP traffic from an NFS server that the device communicates with; no authentication is required in the protocol, so the threat is external. Upon delivery of crafted READLINK responses, the attacker can overwrite critical bootloader variables, thereby causing memory corruption that may lead to denial of service or give the attacker influence over the boot process.