CVE-2026-29008: U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcprxstatemachine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payloadlen to become negative. When the TCPSYNSENT handler calls tcprxuserdata() without invoking tcpseginwnd() validation, the negative payloadlen is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in storeblock(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIGLMB is disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29008?
CVE-2026-29008 has a high severity score of 7.5.
What is CVE-2026-29008 related to?
CVE-2026-29008 is related to an integer underflow vulnerability in U-Boot's tcp_rx_state_machine() function.
How do I fix CVE-2026-29008?
To fix CVE-2026-29008, update your U-Boot version to a patched release that addresses this vulnerability.
Can CVE-2026-29008 be exploited remotely?
Yes, CVE-2026-29008 can be exploited by a network-adjacent attacker.
What is the impact of CVE-2026-29008?
The impact of CVE-2026-29008 is the potential denial of service, causing the bootloader to crash.