CVE-2026-74221

U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK

Published Sep 29, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

Analysis

Technical impact

U‑Boot firmware before version 2026.10‑rc5 suffers from a buffer overflow in the nfs_readlink_reply() function within net/nfs-common.c. When a malicious NFS server replies to a READLINK request with a negative or oversized symlink length, the bootloader incorrectly copies the value into a smaller buffer, corrupting adjacent memory and potentially crashing during the boot process. This flaw, classified as CWE‑195, can lead to denial of service.

Affected Systems

Denx U‑Boot firmware earlier than 2026.10‑rc5 is affected. The vulnerability impacts any device that uses this firmware variant and relies on NFS READLINK handling during boot. Later releases that include the patch are not susceptible.

Risk and Exploitability

With a CVSS score of 8.8, the flaw poses a substantial risk due to memory corruption and loss of system availability. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating that no widespread public exploits have been observed. Exploitation requires control of the NFS server that the bootloader contacts; therefore the threat is limited to environments where the NFS host can be compromised or is untrusted. Successful exploitation would cause a bootloader crash, disrupting normal device operation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

u-boot

unaffected

Version	Status	Constraints
`0`	affected	< 2026.10-rc5

No data.

Vendor Product Versions

Denx

U-boot

Version	Status	Scheme	Platform
`[0,2026.10-rc5)`	affected	generic	—

U-boot

Version	Status	Scheme	Platform
`[0,2026.10-rc5)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade U‑Boot to version 2026.10‑rc5 or later to apply the official fix.
If an upgrade is not immediately possible, restrict NFS server access to trusted hosts or enforce firewall rules to block untrusted NFS traffic.
When possible, disable NFS support in the device’s boot configuration to eliminate the vulnerable READLINK handling path.

Generated by OpenCVE AI on September 30, 2026 at 07:34 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8930-1	U-Boot vulnerabilities
Ubuntu USN	USN-8930-2	U-Boot vulnerabilities

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.339% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/u-boot/u-boot
https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L643
https://github.com/u-boot/u-boot/commit/1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd
https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-readlink

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 30, 2026 4:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		U-boot U-boot u-boot
Vendors & Products		U-boot U-boot u-boot

Sep 29, 2026 9:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
Title		U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
First Time appeared		Denx Denx u-boot
Weaknesses		CWE-195
CPEs		cpe:2.3:a:denx:u-boot::::::::
Vendors & Products		Denx Denx u-boot
References		https://github.com/u-boot/u-boot https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L643 https://github.com/u-boot/u-boot/commit/1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-readlink
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}`