← Vulnerability feed

Vulnerability record · CVE-2026-29009 · published 8 July 2026

CVE-2026-29009: Denx u-boot classic buffer overflow vulnerability

Denx · U Boot

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

8.8 CVSS 4.0 High EPSS 0.74% · top 47.3% CWE-120 · Classic buffer overflow
8.8CVSS 4.0 base score
0.74%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
24 Jul 2026Last modified by NVD

Description

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc
https://git.u-boot-project.org/u-boot/u-boot/-/releases/v2026.07-rc2
https://lists.denx.de/pipermail/u-boot/2026-May/617853.html Mailing ListThird Party Advisory
https://u-boot.org/ Product
https://www.vulncheck.com/advisories/u-boot-rc3-buffer-overflow-in-nfs-readlink-reply-via-nfs-readlink ExploitThird Party Advisory
https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/ ExploitThird Party Advisory

Track CVE-2026-29009 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-34835Denx u-boot out-of-bounds write vulnerabilityIn Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corrupti…EPSS 2.2%9.8CVE-2022-30767Denx u-boot classic buffer overflow vulnerabilitynfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to …EPSS 2.7%9.8CVE-2020-8432Denx u-boot double free vulnerabilityIn Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-wha…EPSS 3.1%9.8CVE-2019-14204Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountal…EPSS 2.7%9.8CVE-2019-14192Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet in…EPSS 2.8%9.8CVE-2019-14193Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" blo…EPSS 2.6%9.8CVE-2019-14194Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_b…EPSS 2.4%9.8CVE-2019-14195Denx u-boot out-of-bounds write vulnerabilityAn issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block…EPSS 2.5%

Source: NIST National Vulnerability Database (record CVE-2026-29009), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.