CVE-2025-70290: Integer Overflow
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using DENX U-Boot versions before 2026.04 with ZFS filesystem support are potentially exposed when U-Boot processes malformed ZFS on-disk metadata during boot.
What does an attacker need to exploit it?
An attacker needs to cause U-Boot to process malformed metadata from a ZFS filesystem. The provided information does not specify how the attacker would obtain control of that storage or metadata.
What is the potential impact during boot?
The integer overflow can cause an incorrect memory allocation followed by out-of-bounds memory access. This may crash the system or potentially permit arbitrary code execution during the boot process.