AI analysis
U-Boot before 2026.10-rc5 has a buffer overflow in nfs_read_reply() in net/nfs-common.c, caused by signed-integer handling of NFS READ reply lengths (CWE-195). A malicious or compromised NFS server can send a crafted reply length that bypasses validation and writes far past the destination buffer. That corrupts memory or crashes the bootloader during network boot; published scoring rates availability impact high and integrity impact low, with no confidentiality impact. Devices that use this U-Boot NFS client path while booting are affected; systems that do not netboot via NFS are not reachable through this flaw. No public proof-of-concept is known, and the issue is not in CISA KEV.
What to do: Upgrade U-Boot to 2026.10-rc5 or later on any device that netboots over NFS. Until then, boot only from trusted local media or a trusted NFS server on a segmented network, and disable the NFS client where it is not required. Confirm the bootloader version and whether NFS boot is actually enabled before treating a fleet as exposed.
Affected
| DENX Software Engineering U-Boot | all versions before 2026.10-rc5 |
Estimated exposure
largeHundreds of millions of devices ship U-Boot; exploitable NFS-netboot setups are likely on the order of low millions or fewer — U-Boot is the dominant bootloader in embedded Linux BSPs, boards, and appliances, implying a very large installed base, but this bug is reachable only when the NFS client runs at boot—a pattern common in labs and diskless systems and…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.