CVE-2026-29008 U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()

🗓️ 08 Jul 2026 16:14:41Reported by GoogleType

osv🔗 osv.dev👁 1 Views

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated ...

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-29008	8 Jul 202616:14	–	attackerkb
Circl	CVE-2026-29008	8 Jul 202617:40	–	circl
CVE	CVE-2026-29008	8 Jul 202616:14	–	cve
Cvelist	CVE-2026-29008 U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()	8 Jul 202616:14	–	cvelist
EUVD	EUVD-2026-42332	8 Jul 202616:14	–	euvd
NVD	CVE-2026-29008	8 Jul 202617:17	–	nvd
OSV	UBUNTU-CVE-2026-29008	9 Jul 202600:00	–	osv
Positive Technologies	PT-2026-56475	8 Jul 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-29008	13 Jul 202613:26	–	redhatcve
SUSE CVE	SUSE CVE-2026-29008	10 Jul 202603:17	–	susecve

Source	Link
u-boot	www.u-boot.org/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29008.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-29008
vulncheck	www.vulncheck.com/advisories/u-boot-rc3-integer-underflow-dos-via-tcp-rx-state-machine
lists	www.lists.denx.de/pipermail/u-boot/2026-May/617853.html
github	www.github.com/u-boot/u-boot

12 Jul 2026 03:55Current

6.1Medium risk

Vulners AI Score6.1

CVSS 48.7

EPSS0.00432