CVE-2026-29008
published 2026-07-08CVE-2026-29008: U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
42.8th percentile
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| denx | u-boot | < 2026.04 | 2026.04 |
| denx | u-boot | — | — |
| denx | u-boot | — | — |
| denx | u-boot | — | — |
| u-boot | u-boot | <= 2026.04-rc3 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
U-Boot up to 2026.04-rc3 TCP_SYN_SENT handler net/tcp.c tcp_rx_state_machine offset integer underflow (Nessus ID 326043)
vuldb·2026-07-12·CVSS 7.5
CVE-2026-29008 [HIGH] U-Boot up to 2026.04-rc3 TCP_SYN_SENT handler net/tcp.c tcp_rx_state_machine offset integer underflow (Nessus ID 326043)
A vulnerability described as very critical has been identified in U-Boot up to 2026.04-rc3. Impacted is the function tcp_rx_state_machine of the file net/tcp.c of the component TCP_SYN_SENT handler. The manipulation of the argument offset results in integer underflow.
This vulnerability is known as CVE-2026-29008. It is possible to launch the attack remotely. No exploit is available.
GHSA
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a m
ghsa_unreviewed·2026-07-08
CVE-2026-29008 [HIGH] CWE-191 U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a m
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-29008 uboot-tools: U-Boot: Integer underflow leads to Denial of Service [fedora-all]
bugzilla·2026-07-13·CVSS 7.5
CVE-2026-29008 [HIGH] CVE-2026-29008 uboot-tools: U-Boot: Integer underflow leads to Denial of Service [fedora-all]
CVE-2026-29008 uboot-tools: U-Boot: Integer underflow leads to Denial of Service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integ
Bugzilla
CVE-2026-29008 uboot-tools: U-Boot: Integer underflow leads to Denial of Service [epel-all]
bugzilla·2026-07-13·CVSS 7.5
CVE-2026-29008 [HIGH] CVE-2026-29008 uboot-tools: U-Boot: Integer underflow leads to Denial of Service [epel-all]
CVE-2026-29008 uboot-tools: U-Boot: Integer underflow leads to Denial of Service [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer
Bugzilla
CVE-2026-29008 U-Boot: U-Boot: Integer underflow leads to Denial of Service
bugzilla·2026-07-08·CVSS 7.5
CVE-2026-29008 [HIGH] CVE-2026-29008 U-Boot: U-Boot: Integer underflow leads to Denial of Service
CVE-2026-29008 U-Boot: U-Boot: Integer underflow leads to Denial of Service
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
2026-07-08
Published