CVE-2026-50719: Ingenic T41 SoC boot ROM vulnerability
The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices using the Ingenic T41 are confirmed affected when secure boot is enabled. T32, T40, and A1 boot ROMs have closely related behavior confirmed through ROM analysis, but hardware validation is only stated for T41.
What does an attacker need to exploit it?
The attacker needs physical write access to the device's boot media. They can alter the SPL header's attacker-controlled init table to modify SRAM-resident secure boot state before signature verification occurs.
Does secure boot protect affected devices by default?
No. On the validated T41 scenario, an init-table entry can disable the secure boot check before the ROM makes its verification decision, allowing unsigned or modified first-stage boot code to be accepted.
How can I tell whether a device may be affected?
Identify whether the device uses an Ingenic T41, T32, T40, or A1 SoC and whether an attacker could obtain physical write access to its boot media. T41 behavior has been hardware-validated; the other listed SoCs are supported by ROM analysis.