CVE-2026-74222: U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and crash the bootloader.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.10-rc5
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to be able to provide HTTP data to the affected lwIP wget client and trigger an HTTP data-storage failure. The vulnerable receive callback then frees the connection PCB while returning ERR_BUF, allowing subsequent TCP processing to access released memory.
What is the expected impact?
The described outcome is a bootloader crash caused by use-after-free access in the TCP input path. The supplied vector rates availability impact as high and integrity impact as low, with no confidentiality impact.
Which versions should be considered affected?
U-Boot versions before 2026.10-rc5 are affected according to the available information. The issue is fixed by the referenced U-Boot commit 2d94618a58aeb7630f18eee33419ce48d0fd3616.