CVE-2026-29008: U-Boot TCP Integer Underflow Denial of Service Vulnerability

Technical summary

CVE-2026-29008 is an integer underflow vulnerability in U-Boot's TCP implementation (tcp_rx_state_machine() function in net/tcp.c). When processing an inbound TCP SYN+ACK packet, the code fails to validate the packet's data offset field before calculating payload_len. A negative payload_len value is then implicitly cast to a large unsigned integer and passed to memcpy() in store_block(), triggering a denial of service. The root cause is the absence of tcp_seg_in_wnd() validation checks before invoking tcp_rx_user_data() in the TCP_SYN_SENT handler. With CONFIG_LMB disabled, the vulnerability can progress beyond a simple crash and potentially corrupt memory regions.

Business impact

Devices relying on affected U-Boot versions for secure boot are at risk of boot failure, which can cascade into operational downtime and supply-chain vulnerabilities. For embedded systems in production environments—particularly IoT devices, network appliances, and industrial equipment—a boot-time denial of service means devices become unreachable and require manual intervention or physical access to recover. In scenarios where attackers are network-adjacent (same subnet or VLAN), repetitive triggering of this crash could be weaponized to disable critical infrastructure or prevent legitimate firmware updates.

Affected systems

All DENX U-Boot releases through version 2026.04-rc3 are affected. U-Boot is the de facto bootloader for a vast ecosystem of ARM, PowerPC, MIPS, and x86 embedded systems—including development boards, consumer routers, industrial controllers, and security appliances. Any device shipping with an unpatched U-Boot build from this release range is potentially vulnerable if it is reachable over a network during the boot sequence.

Exploitability

The vulnerability is highly exploitable with a CVSS 3.1 score of 7.5 (HIGH). The attack vector is network-based with no authentication or user interaction required, and the precondition of network adjacency is common in most deployed scenarios. Exploitation requires only the ability to send a single crafted TCP packet, making the barrier to entry extremely low. Tools to generate malformed TCP packets are trivial to construct. No exploit is known to have been publicly disclosed or weaponized, but the simplicity of the attack means weaponization risk is elevated.

Remediation

Apply updates released after 2026.04-rc3 once available from DENX. Verify the specific patch version against the vendor's official advisory before deployment. As an interim measure, restrict network access to devices during boot—if possible via network segmentation, firewall rules, or physical isolation. Disable or review the implications of CONFIG_LMB in your build configuration, as this setting controls whether the vulnerability can escalate beyond denial of service into memory corruption. Test patches in a controlled environment before production rollout.

Patch guidance

Monitor the DENX U-Boot repository and release notes for versions beyond 2026.04-rc3. Patches will likely target the tcp_rx_state_machine() function to add proper bounds checking on the data offset field and enforce tcp_seg_in_wnd() validation before processing user data. When patches are released, verify version numbers against the official advisory and perform integrity checks on downloaded binaries. Coordinate patching with your board support package (BSP) maintainers if you rely on customized U-Boot builds. Test patches in staging environments that mirror production hardware and network conditions.

Detection guidance

Monitor network traffic for malformed TCP packets with suspicious data offset values directed at devices during their boot sequence. If you have access to device logs or serial console output, watch for unexpected crashes or resets immediately following network initialization. Check U-Boot version strings on deployed devices via DHCP request inspection, serial console access, or firmware interrogation. Perform a software bill of materials (SBOM) audit of all embedded systems to identify which devices carry U-Boot 2026.04-rc3 or earlier. Alert on any abnormal boot failures that correlate with network traffic patterns, particularly repeated packet bursts from untrusted subnets.

Why prioritize this

This is a HIGH-severity vulnerability affecting a critical system component (the bootloader) with trivial exploitability and no authentication barriers. The denial-of-service impact directly threatens device availability and can render systems inoperable. Although not yet in the CISA KEV catalog, the low attack complexity and high potential impact on distributed embedded systems warrant immediate investigation and patching in organizations with significant U-Boot deployments. Prioritize devices in sensitive environments (OT, IoT infrastructure, security appliances) and those exposed to untrusted networks.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible vulnerability with low attack complexity and no privilege or user interaction requirements. The severity is constrained to availability impact (boot denial) rather than confidentiality or integrity under normal configurations. However, the score does not capture the real-world severity in embedded systems contexts: bootloader compromise can be a vector for persistent attacks if memory corruption is triggered. Organizations should consider this a higher-priority target than the base score alone suggests due to the criticality of the affected component.

Frequently asked questions