CVE-2026-29007: U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcprxstatemachine() (net/tcp.c) when CONFIGPROTTCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcpparseoptions() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmtwinscale and rmttimestamp to disrupt TCP window calculations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.04-rc3 - Configuration
If feasible, disable CONFIG_PROT_TCP in U-Boot to avoid the out-of-bounds read in tcp_rx_state_machine() when CONFIG_PROT_TCP is enabled.
U-Boot net/tcp.c (tcp_rx_state_machine via tcp_parse_options) CONFIG_PROT_TCP = disabled - Compensating control
Apply a network-level compensating control to prevent remote attackers from delivering crafted TCP packets that mismatch the IP total length and TCP data offset (e.g., drop or filter such malformed packets at the perimeter/edge firewall or ingress device).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29007?
CVE-2026-29007 has a medium severity rating of 5.3.
How do I fix CVE-2026-29007?
To fix CVE-2026-29007, update U-Boot to a version higher than 2026.04-rc3 where the vulnerability has been patched.
What type of vulnerability is CVE-2026-29007?
CVE-2026-29007 is an out-of-bounds read vulnerability in the tcp_rx_state_machine function.
What software does CVE-2026-29007 affect?
CVE-2026-29007 affects U-Boot versions through 2026.04-rc3.
What could an attacker achieve with CVE-2026-29007?
An attacker could read beyond TCP segment boundaries by sending a crafted malicious packet.