USN-8930-1: U-Boot vulnerabilities
Ubuntu fixed U-Boot flaws that could crash systems or execute code through NFS or HTTP handling.
Ubuntu published USN-8930-1 covering U-Boot flaws found by Shahriyar Jalayeri and Mehrun P. Hunter. Crafted NFS READ and READLINK responses can trigger buffer overflows that may cause denial of service or arbitrary code execution (CVE-2026-74220, CVE-2026-74221). A separate lwIP HTTP storage-failure bug can cause a use-after-free and denial of service (CVE-2026-74222), affecting only Ubuntu 24.04 LTS and 26.04 LTS. No exploitation is reported.
- CVE-2026-74220 and CVE-2026-74221 are NFS response buffer overflows.
- Those flaws may cause denial of service or code execution.
- CVE-2026-74222 is an lwIP use-after-free on Ubuntu 24.04 and 26.04 LTS.
Vulnerabilities mentionedAll →
- CVE-2026-742208.8—NFS reply buffer overflow in U-Boot before 2026.10-rc5published · DENX Software Engineering U-Boot+2 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-74220+2 related CVEs | NFS reply buffer overflow in U-Boot before 2026.10-rc5 U-Boot before 2026.10-rc5 has a buffer overflow in nfs_read_reply() in net/nfs-common.c, caused by signed-integer handling of NFS READ reply lengths (CWE-195). A malicious or compromised NFS server can send a crafted reply length that bypasses validation and writes far past the destination buffer. That corrupts memory or crashes the bootloader during network boot; published scoring rates availability impact high and integrity impact low, with no confidentiality impact. Devices that use this U-Boot NFS client path while booting are affected; systems that do not netboot via NFS are not reachable through this flaw. No public proof-of-concept is known, and the issue is not in CISA KEV. |
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did…
This source does not provide full text. Read it at ubuntu.com.