Vulnerability record · CVE-2026-29008 · published 8 July 2026

CVE-2026-29008: Denx u-boot vulnerability

Denx · U Boot

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.

8.7 CVSS 4.0 High EPSS 0.71% · top 48.5% CWE-191 · CWE-191

8.7CVSS 4.0 base score

0.71%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

22 Jul 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

U Boot Denx

References

Link	Tags
https://lists.denx.de/pipermail/u-boot/2026-May/617853.html	Mailing ListThird Party Advisory
https://u-boot.org/	Product
https://www.vulncheck.com/advisories/u-boot-rc3-integer-underflow-dos-via-tcp-rx-state-machine	Third Party AdvisoryExploit
https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/	Third Party AdvisoryExploit

Track CVE-2026-29008 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-34835Denx u-boot out-of-bounds write vulnerabilityIn Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corrupti…EPSS 2.2%30 Jun 2022 9.8CVE-2022-30767Denx u-boot classic buffer overflow vulnerabilitynfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to …EPSS 2.7%16 May 2022 9.8CVE-2020-8432Denx u-boot double free vulnerabilityIn Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-wha…EPSS 3.1%29 Jan 2020 9.8CVE-2019-14204Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountal…EPSS 2.7%31 Jul 2019 9.8CVE-2019-14192Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet in…EPSS 2.8%31 Jul 2019 9.8CVE-2019-14193Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" blo…EPSS 2.6%31 Jul 2019 9.8CVE-2019-14194Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_b…EPSS 2.4%31 Jul 2019 9.8CVE-2019-14195Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block…EPSS 2.5%31 Jul 2019

Source: NIST National Vulnerability Database (record CVE-2026-29008), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.