CVE-2026-29007: U-Boot TCP Out-of-Bounds Read DoS Vulnerability

Technical summary

CVE-2026-29007 is an out-of-bounds read vulnerability in the tcp_rx_state_machine() function within net/tcp.c of U-Boot. When CONFIG_PROT_TCP is enabled, the vulnerability arises from insufficient validation of IP and TCP header field consistency. Specifically, an attacker crafts a packet where the IP total length field (e.g., 40 bytes) does not match the TCP data offset field (e.g., claiming 60 bytes of header). This causes tcp_parse_options() to perform an out-of-bounds read, accessing memory 40 bytes past the actual TCP segment boundary. The read can corrupt critical TCP connection state variables including rmt_win_scale (remote window scale) and rmt_timestamp, disrupting TCP window size calculations and potentially destabilizing the connection state machine.

Business impact

Devices running affected U-Boot versions with TCP networking enabled face denial of service risk. An attacker on the network can trigger connection disruptions, causing network services to fail or become unreliable. For embedded systems and IoT devices that rely on U-Boot for boot and runtime network operations—such as firmware downloads, remote management, or automated deployment—this vulnerability could prevent legitimate network communication. In critical infrastructure or industrial IoT scenarios, connection instability could cascade into service unavailability.

Affected systems

U-Boot versions through 2026.04-rc3 are affected when compiled with CONFIG_PROT_TCP enabled. Any embedded system or device using these U-Boot versions for bootloading or runtime network functionality is potentially exposed. This includes single-board computers, network switches with U-Boot, IoT devices, and embedded Linux systems. Systems without TCP support explicitly enabled in U-Boot are not affected.

Exploitability

The vulnerability is readily exploitable. No authentication, user interaction, or special privileges are required; only network connectivity to the target device is necessary. An attacker can send a single malicious TCP packet to trigger the out-of-bounds read. The attack surface is broad because any device with U-Boot listening on a network interface with TCP enabled is vulnerable. However, the attack is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation may not yet be widespread.

Remediation

Users should upgrade U-Boot to a patched version released after 2026.04-rc3 that includes fixes for the tcp_rx_state_machine() and tcp_parse_options() validation logic. Verify the specific patched version in the official DENX U-Boot advisory. As an interim measure, disable TCP networking (CONFIG_PROT_TCP) in U-Boot if it is not operationally required. Restrict network access to U-Boot services where possible through firewall rules or network segmentation.

Patch guidance

Monitor the DENX U-Boot project repository and release notes for a patched version addressing the out-of-bounds read in tcp_rx_state_machine(). Once available, rebuild and redeploy U-Boot with the patch applied. Test the patched version in a non-production environment to ensure compatibility with your embedded system's hardware and existing configuration before rolling out to production devices. If your devices are in the field, coordinate a firmware update strategy that minimizes downtime.

Detection guidance

Network-based detection is challenging because the malicious packet itself is not inherently identifiable by signature alone. Monitor for TCP connection errors, unexpected resets, or state machine anomalies in devices running affected U-Boot versions. System-level detection may involve observing memory corruption indicators or connection state inconsistencies. Conduct a configuration audit to identify all devices with U-Boot and CONFIG_PROT_TCP enabled. Deploy a patch management process to track U-Boot versions across your infrastructure and prioritize systems exposed to untrusted networks.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score (5.3) reflecting limited confidentiality or integrity impact, the combination of unauthenticated network exploitability, ease of trigger, and widespread use of U-Boot in embedded systems warrants prompt attention. Denial of service in bootloaders and network-critical firmware can have outsized operational impact. Prioritize patching for devices exposed to untrusted networks or those critical to your organization's operational continuity.

Risk score, explained

CVSS 3.1 score of 5.3 (MEDIUM) reflects: AV:N (network-accessible attack vector), AC:L (low attack complexity—no special conditions required), PR:N (no privileges needed), UI:N (no user interaction), S:U (single trust boundary), and A:L (low availability impact via denial of service). The score does not credit confidentiality or integrity impact because the out-of-bounds read itself does not leak sensitive data to the attacker; rather, it corrupts internal state. However, the practical risk may be higher in mission-critical embedded environments where network unavailability is operationally severe.

Frequently asked questions