CVE-2026-71971: U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.10-rc3
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running U-Boot versions before 2026.10-rc3 are exposed when CONFIG_IP_DEFRAG is enabled and the bootloader is performing netboot. The attack can be delivered remotely over the network.
What does an attacker need to exploit the vulnerability?
An attacker needs network reachability to the target during netboot and must send a crafted IP fragment with a non-zero fragment offset and the More-Fragments flag set. No authentication or user interaction is required.
Is the default configuration affected?
The issue is conditional on CONFIG_IP_DEFRAG being enabled. The provided information does not state whether that option is enabled by default in any U-Boot configuration.
What is the likely impact of a successful attack?
A crafted fragment can cause an out-of-bounds write that corrupts adjacent memory and crashes the bootloader. The reported impact includes high availability impact and low integrity impact.
What can be done if upgrading is not immediately possible?
Reduce or prevent untrusted network access during netboot, since exploitation requires delivery of crafted IP fragments while netboot is active. Systems without CONFIG_IP_DEFRAG enabled are not described as affected.