AI analysis
U-Boot before 2026.10-rc5 has a buffer overflow in nfs_readlink_reply() in net/nfs-common.c when it handles NFS READLINK replies. A malicious or compromised NFS server can send a crafted reply with a negative or oversized symlink length; a signed-to-unsigned conversion (CWE-195) turns that length into an excessive size and corrupts bootloader memory. The practical impact described is memory corruption and a bootloader crash (high availability impact, low integrity impact); this is not an unauthenticated remote attack against a running OS, and it requires the device to process NFS responses from an attacker-controlled server, typically during network boot. Embedded boards, appliances, and other devices that use a vulnerable U-Boot build with the NFS client path are affected. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade U-Boot to 2026.10-rc5 or later on devices that netboot or otherwise process NFS replies in the bootloader. Until then, do not NFS-boot from untrusted or unverified servers, and restrict which hosts can answer DHCP/BOOTP and NFS during boot.
Affected
| DENX Software Engineering U-Boot | before 2026.10-rc5 |
Estimated exposure
largemillions of devices ship U-Boot; only the NFS-netboot subset before 2026.10-rc5 is exposed (no public count) — U-Boot is the standard bootloader on a very large share of embedded Linux boards, routers, and appliances, so the vulnerable code is widely shipped; the bug is only reachable when the bootloader handles NFS READLINK replies, and there is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.