U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfsreadlinkreply() (net/nfs-common.c) when CONFIGCMDNFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfspathbuff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfsserverip, nfsservermountport, nfsserverport, nfsourport, nfsstate, and rpcid, potentially achieving memory corruption and control over the NFS client state machine.

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcprxstatemachine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payloadlen to become negative. When the TCPSYNSENT handler calls tcprxuserdata() without invoking tcpseginwnd() validation, the negative payloadlen is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in storeblock(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIGLMB is disabled.

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcprxstatemachine() (net/tcp.c) when CONFIGPROTTCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcpparseoptions() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmtwinscale and rmttimestamp to disrupt TCP window calculations.