CVE-2026-29009

Name
CVE-2026-29009
Description
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://lists.denx.de/pipermail/u-boot/2026-May/617853.html
disclosure@vulncheck.com https://u-boot.org/
disclosure@vulncheck.com https://www.vulncheck.com/advisories/u-boot-rc3-buffer-overflow-in-nfs-readlink-reply-via-nfs-readlink
disclosure@vulncheck.com https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
disclosure@vulncheck.com https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc
disclosure@vulncheck.com https://git.u-boot-project.org/u-boot/u-boot/-/releases/v2026.07-rc2

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:* u-boot >= None < 2026.04

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
u-boot edge-main 2026.01-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2026.01-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.04-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.04-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.01-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2024.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2024.10-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.23-main 2025.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.23-main 2025.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2021.04-r0 None possibly vulnerable
u-boot 3.21-main 2024.10-r8 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2021.04-r0 None possibly vulnerable
u-boot 3.20-main 2024.04-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2021.04-r0 None possibly vulnerable
u-boot 3.19-main 2023.10-r9 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r8 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2021.04-r0 None possibly vulnerable