U-Boot (Product): news timeline & CVEs

USN-8930-1: U-Boot vulnerabilities

Ubuntu fixed U-Boot flaws that could crash systems or execute code through NFS or HTTP handling.

Ubuntu published USN-8930-1 covering U-Boot flaws found by Shahriyar Jalayeri and Mehrun P. Hunter. Crafted NFS READ and READLINK responses can trigger buffer overflows that may cause denial of service or arbitrary code execution (CVE-2026-74220, CVE-2026-74221). A separate lwIP HTTP storage-failure bug can cause a use-after-free and denial of service (CVE-2026-74222), affecting only Ubuntu 24.04 LTS and 26.04 LTS. No exploitation is reported.

Ubuntu Security Noticesupdated Oct 15, 17:27 UTC · 1d agofirst Oct 14, 16:23 UTC · 2d agoAdvisory 5 sources CVE-2026-74220 CVE-2026-74221 CVE-2026-742221· 1 read

USN-8884-1: U-Boot vulnerabilities

Ubuntu patches U-Boot flaws where crafted ZFS or ext4 metadata can cause code execution or denial of service.

Ubuntu published USN-8884-1 for U-Boot vulnerabilities found by Timo Preißl. CVE-2025-70290 is an integer overflow in handling malformed ZFS filesystem metadata that can lead to out-of-bounds memory access, arbitrary code execution, or denial of service. A second issue miscalculates buffer sizes for certain ext4 filesystems with the same impact, affecting Ubuntu 18.04 LTS through 26.04 LTS. The notice does not report active exploitation.

Ubuntu Security NoticesOct 6, 16:09 UTC · 10d agoAdvisory CVE-2025-702903· 1 read

U-Boot

Timeline2 articles

Related CVEsby mentions

Appears with

USN-8930-1: U-Boot vulnerabilities

USN-8884-1: U-Boot vulnerabilities