U‑Boot firmware before version 2026.10‑rc5 suffers from a buffer overflow in the nfs_readlink_reply() function within net/nfs-common.c. When a malicious NFS server replies to a READLINK request with a negative or oversized symlink length, the bootloader incorrectly copies the value into a smaller buffer, corrupting adjacent memory and potentially crashing during the boot process. This flaw, classified as CWE‑195, can lead to denial of service.

Denx U‑Boot firmware earlier than 2026.10‑rc5 is affected. The vulnerability impacts any device that uses this firmware variant and relies on NFS READLINK handling during boot. Later releases that include the patch are not susceptible.

With a CVSS score of 8.8, the flaw poses a substantial risk due to memory corruption and loss of system availability. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread public exploits have been observed. Exploitation requires control of the NFS server that the bootloader contacts; therefore the threat is limited to environments where the NFS host can be compromised or is untrusted. Successful exploitation would cause a bootloader crash, disrupting normal device operation.