CVE-2026-74220: U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
U-Boot versions before 2026.10-rc5 are affected when they process NFS READ replies. Exposure requires the bootloader to communicate with an NFS server that can provide the crafted reply.
What does an attacker need to exploit it?
An attacker needs to operate or control a malicious NFS server, or otherwise be able to supply crafted NFS READ reply lengths to the affected U-Boot instance. No privileges or user interaction are required according to the supplied severity vector.
What is the likely impact of successful exploitation?
A crafted reply can bypass length validation and write far beyond the destination buffer. This can crash the bootloader or corrupt its memory; the provided vector rates availability impact as high and integrity impact as low.
How can I determine whether a device is affected?
Check the U-Boot version and whether the device uses NFS functionality that processes READ replies. Versions before 2026.10-rc5 should be treated as affected.