CVE-2026-29007 U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c

🗓️ 08 Jul 2026 16:11:25Reported by GoogleType

osv🔗 osv.dev👁 2 Views

CVE-2026-29007: U-Boot 2026.04-rc3 allows out-of-bounds read in tcp_rx_state_machine via crafted packet with mismatched IP length and TCP data offset.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-29007	8 Jul 202616:11	–	attackerkb
Circl	CVE-2026-29007	11 Jul 202612:01	–	circl
CVE	CVE-2026-29007	8 Jul 202616:11	–	cve
Cvelist	CVE-2026-29007 U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c	8 Jul 202616:11	–	cvelist
EUVD	EUVD-2026-42328	8 Jul 202616:11	–	euvd
NVD	CVE-2026-29007	8 Jul 202617:17	–	nvd
OSV	DEBIAN-CVE-2026-29007	8 Jul 202617:17	–	osv
OSV	UBUNTU-CVE-2026-29007	9 Jul 202600:00	–	osv
Positive Technologies	PT-2026-56474	8 Jul 202600:00	–	ptsecurity
SUSE CVE	SUSE CVE-2026-29007	10 Jul 202603:17	–	susecve

Source	Link
u-boot	www.u-boot.org/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29007.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-29007
vulncheck	www.vulncheck.com/advisories/u-boot-rc3-out-of-bounds-read-in-tcp-rx-state-machine-via-tcp-c
lists	www.lists.denx.de/pipermail/u-boot/2026-May/617853.html
github	www.github.com/u-boot/u-boot
y637f9qq2x	www.y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/

14 Jul 2026 04:02Current

6.1Medium risk

Vulners AI Score6.1

CVSS 46.9

EPSS0.00467

U-Boot out of bounds read tcp_rx_state_machine ip total length tcp data offset crafted packet remote attacker remote window scale remote timestamp window calculations uboot