CVE-2026-29009: U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfsreadlinkreply() (net/nfs-common.c) when CONFIGCMDNFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfspathbuff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfsserverip, nfsservermountport, nfsserverport, nfsourport, nfsstate, and rpcid, potentially achieving memory corruption and control over the NFS client state machine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.07-rc2Patch Buffer Overflow in nfs_readlink_reply() via NFS READLINK - Compensating control
If feasible, disable NFS client functionality (CONFIG_CMD_NFS) to avoid the nfs_readlink_reply() code path vulnerable to overflowing nfs_path_buff via multiple relative symlink targets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29009?
The severity of CVE-2026-29009 is rated as high, with a CVSS score of 8.2.
How do I fix CVE-2026-29009?
To fix CVE-2026-29009, disable the CONFIG_CMD_NFS option if it is not necessary for your U-Boot environment.
What causes CVE-2026-29009?
CVE-2026-29009 is caused by a buffer overflow vulnerability in the nfs_readlink_reply() function when multiple relative symlink targets are returned.
What software is affected by CVE-2026-29009?
CVE-2026-29009 affects U-Boot versions up to and including 2026.04-rc3.
What impact does CVE-2026-29009 have?
CVE-2026-29009 allows a malicious NFS server to potentially execute arbitrary code due to the buffer overflow.