CVE-2026-29009: u-boot before 2026.04 (exclusive), 2026.04 · update rc1, 2026.04 · update rc2 (+2 more affected versions)

Affected technology

u-boot · before 2026.04 (exclusive)
denx

u-boot · 2026.04 · update rc1
denx

u-boot · 2026.04 · update rc2
denx

u-boot · 2026.04 · update rc3
denx

u-boot · 0 to before 2026.07-rc2
u-boot

Description’s affected range: before 2026.07-rc2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine. Vendor/CNA’s CVSS 4.0 assessment (base score 8.8/10) rates confidentiality impact as none; integrity impact as low; availability impact as high.