OESA-2026-4844: uboot-tools security update

This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fix(es):

U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.(CVE-2026-71971)

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.(CVE-2026-71972)

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.(CVE-2026-71973)

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.(CVE-2026-74220)

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.(CVE-2026-74221)