U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK

Advisories

U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK

severity: high
date: 9/29/2026
Affecting: u-boot >= 0, < 2026.10-rc5
CVE: CVE-2026-74221
CWE: CWE-195 Signed to Unsigned Conversion Error
CVSS: 8.8
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
References: https://github.com/u-boot/u-boot/commit/1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd
https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L643
https://github.com/u-boot/u-boot
Credit: Shahriyar Jalayeri (ByteRay Ltd.), Mehrun P. Hunter (ByteRay Ltd.)
Description: U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo