PT-2026-56475 · U-Boot · U-Boot

Vulncheck · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-29008

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.04-rc3

Description An integer underflow exists in the tcp rx state machine() function within net/tcp.c. A network-adjacent attacker can trigger this by sending a malformed TCP SYN+ACK packet with a manipulated data offset field, causing the payload len variable to become negative. When the TCP SYN SENT handler calls tcp rx user data() without performing tcp seg in wnd() validation, this negative value is converted to a large unsigned integer and passed to memcpy() in the store block() function. This results in an immediate crash that prevents the device from booting and may lead to memory corruption if CONFIG LMB is disabled.

Recommendations Update U-Boot to version 2026.04-rc3 or later.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-29008

Affected Products

U-Boot

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-29008 · Security Note
• https://twitter.com/CVEnew/status/2074931633862434969 · Twitter Post
• https://u-boot.org · Note
• https://vulncheck.com/advisories/u-boot-rc3-integer-underflow-dos-via-tcp-rx-state-machine · Note
• https://lists.denx.de/pipermail/u-boot/2026-May/617853.html · Note