CVE-2026-74221

Versions of U-Boot prior to 2026.10-rc5 are susceptible to a buffer overflow in the nfs_readlink_reply() function located in net/nfs-common.c. The vulnerability occurs when the bootloader processes responses from an NFS server that provides crafted READLINK replies containing negative or oversize...

CVE-2026-74222 U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

CVE-2026-74222

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

CVE-2026-74222

U-Boot versions before 2026.10-rc5 are vulnerable to a use-after-free flaw in the httpc_recv_cb() function of the lwIP wget implementation. The vulnerability occurs when HTTP data storage fails: the callback frees the connection PCB but incorrectly returns ERR_BUF instead of ERR_ABRT. This error ...

CVE-2026-74221 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader...

CVE-2026-74220

U-Boot versions prior to 2026.10-rc5 are vulnerable to a buffer overflow within the nfs_read_reply() function located in net/nfs-common.c. The flaw stems from improper signed integer handling , which allows a malicious NFS server to provide crafted NFS READ reply lengths that bypass validation. T...

CVE-2026-74220 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-74220 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-74220 U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-74220

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-71973

U-Boot versions before 2026.10-rc4 are susceptible to an integer overflow vulnerability within the sqfs_read_directory_table() function. The flaw occurs during the allocation of the directory table buffer when processing a crafted SquashFS image containing an attacker-controlled metastblks_count ...

CVE-2026-71974 U-Boot before 2026.10-rc3 Out-of-Bounds Write via Android Bootmeth Partition Read

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-71974

U-Boot versions prior to 2026.10-rc3 are vulnerable to an out-of-bounds write in the read_slotted_partition() function. The flaw exists because the system fails to validate image sizes against partition bounds. An attacker with physical access can exploit this by providing crafted boot media cont...

CVE-2026-71973 U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71974

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-71973

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-71972 U-Boot through 2026.10-rc5 Out-of-Bounds Write in BMP RLE8 Decoder

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader...