CVE-2026-29009: U-Boot NFS Buffer Overflow – Bootloader Memory Corruption Risk

Technical summary

The nfs_readlink_reply() function in net/nfs-common.c (CONFIG_CMD_NFS enabled) fails to validate cumulative buffer length when processing multiple READLINK responses from an NFS server. The nfs_path_buff buffer is fixed at 2048 bytes, but an attacker can return multiple relative symlink targets of ~1100 bytes each without triggering bounds checking. This causes a heap/stack overflow corrupting adjacent BSS variables: nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id. Corruption of these state variables can compromise the NFS client state machine and potentially enable further exploitation. The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input).

Business impact

Organizations deploying U-Boot in networked embedded systems (IoT devices, industrial controllers, network appliances) that boot or mount filesystems over NFS face risk of device compromise during the boot phase—a particularly critical attack surface because bootloader vulnerabilities can bypass operating system-level security controls. Attackers gaining control at this stage can inject malicious code or configurations that persist through system restarts. Supply chain implications exist if devices are PXE-booted or provisioned through centralized NFS infrastructure that could be compromised. Impact ranges from denial of service (boot failure) to potential code execution depending on memory layout and adjacent variable exploitation.

Affected systems

U-Boot versions prior to 2026.07-rc2 with CONFIG_CMD_NFS enabled are affected. This includes embedded Linux systems, IoT devices, industrial equipment, and network appliances that use U-Boot as their primary bootloader and are configured to support NFS boot or filesystem mounting. The vulnerability requires that the affected device connects to or trusts an NFS server, limiting exposure in air-gapped or locally-booted environments. Verify your specific U-Boot build configuration; the vulnerability only manifests when NFS support is compiled in.

Exploitability

Exploitation requires network-level access to act as or compromise the NFS server that a target device contacts. This is a realistic threat in shared infrastructure, cloud environments, and supply-chain boot scenarios, but less likely in isolated or physically secure deployments. The attack is not user-interactive; no end-user action is required once the device attempts an NFS transaction. The CVSS 3.1 score of 8.2 (HIGH) reflects high network accessibility and availability impact, though integrity impact is limited to memory corruption rather than direct code execution. The vulnerability has not been designated as actively exploited in the wild (not on CISA KEV list as of data publication).

Remediation

Upgrade U-Boot to version 2026.07-rc2 or later. Verify this applies to your specific build and configuration. If immediate patching is not possible, mitigate by: (1) restricting network access to trusted NFS servers only (network segmentation, firewall rules); (2) disabling CONFIG_CMD_NFS at compile time if NFS boot is not required; (3) using secure boot mechanisms to detect bootloader tampering; (4) deploying devices in environments where NFS servers are under your direct control and monitoring. For development and testing environments, isolate NFS infrastructure.

Patch guidance

Monitor DENX U-Boot release notes and security advisories for availability of 2026.07-rc2 or the first stable release following it. Release candidates are typically superseded by stable releases; prioritize stable patch availability. When patching: (1) recompile U-Boot with your existing configuration to ensure CONFIG_CMD_NFS remains enabled if needed, or disable it if NFS is unused; (2) test boot sequences in a staging environment; (3) verify device functionality with trusted NFS servers; (4) document the U-Boot version and build configuration for compliance and incident response. Consider automating firmware distribution in your organization to ensure consistent patch deployment across device fleets.

Detection guidance

Detection at runtime is challenging because corruption occurs in bootloader memory before the OS kernel loads. Implement detection by: (1) monitoring NFS server logs for unusual READLINK responses or repeated/oversized symlink targets; (2) analyzing network traffic for NFS protocol anomalies (e.g., READLINK responses that deviate from normal patterns); (3) using secure boot attestation to verify bootloader integrity if supported by your hardware; (4) logging boot failures or unexpected device behavior correlated with NFS boot attempts. Post-boot validation: If a device boots successfully after an NFS anomaly, inspect dmesg/system logs for memory corruption indicators (segfaults, BUG messages). Device monitoring solutions that track firmware version and build configuration can help identify vulnerable deployments.

Why prioritize this

This vulnerability warrants HIGH priority for organizations using U-Boot in production embedded systems with NFS boot or mount capability. Bootloader-level attacks are high-stakes because they occur before OS security mechanisms load. The CVSS 8.2 score and availability/integrity impact justify rapid assessment and patching. However, practical risk depends on your NFS infrastructure trust model: isolated, controlled NFS environments present lower risk than shared or public networks. Organizations should first inventory U-Boot deployments, confirm which have CONFIG_CMD_NFS enabled, and assess whether each is exposed to untrusted NFS servers.

Risk score, explained

CVSS 3.1 score of 8.2 (HIGH) reflects: Network vector (AV:N) due to NFS server accessibility; low complexity attack (AC:L); no privileges required (PR:N); no user interaction (UI:N); no scope change (S:U); no confidentiality impact (C:N); limited integrity impact (I:L) from memory corruption; and high availability impact (A:H) from potential device compromise/boot failure. The score appropriately captures the seriousness of bootloader corruption balanced against the requirement for network access to a trusted service. Organizational risk may be higher if NFS infrastructure is shared or externally hosted.

Frequently asked questions