← Back to CVE Explorer

CVE-2026-29009

Full vulnerability record from the local CVENow database.

Description

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

Severity
HIGH
CVSS score
8.8 (v4.0)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2026-07-08 17:17:21.173000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-29009",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T17:17:21.173",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine."
    },
    {
      "lang": "es",
      "value": "U-Boot hasta 2026.04-rc3 contiene una vulnerabilidad de desbordamiento de búfer en nfs_readlink_reply() (net/nfs-common.c) cuando CONFIG_CMD_NFS está habilitado, permitiendo a un servidor NFS malicioso o comprometido desbordar el búfer nfs_path_buff de 2048 bytes al devolver múltiples destinos de enlace simbólico relativos que se añaden sin validación de longitud acumulativa. Los atacantes pueden enviar dos o más respuestas READLINK que contienen destinos de enlace simbólico relativos de aproximadamente 1100 bytes cada uno para corromper variables BSS adyacentes incluyendo nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state y rpc_id, logrando potencialmente corrupción de memoria y control sobre la máquina de estados del cliente NFS."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "u-boot",
          "product": "u-boot",
          "defaultStatus": "affected",
          "repo": "https://github.com/u-boot/u-boot",
          "packageURL": "pkg:github/u-boot/u-boot",
          "versions": [
            {
              "version": "0",
              "lessThan": "2026.07-rc2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T16:36:54.591359Z",
          "id": "CVE-2026-29009",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2026.04",
              "matchCriteriaId": "097D2949-BA7E-411B-81C1-7AADF57C4849"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:denx:u-boot:2026.04:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "39D97BA6-0B7B-4633-971E-3C79C58A57A5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:denx:u-boot:2026.04:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "94B93B6C-02D1-42C9-B862-C945511A0297"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:denx:u-boot:2026.04:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "86FAEAE1-FCD8-426D-9452-E1885014C9A9"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc",
      "source": "[email protected]"
    },
    {
      "url": "https://git.u-boot-project.org/u-boot/u-boot/-/releases/v2026.07-rc2",
      "source": "[email protected]"
    },
    {
      "url": "https://lists.denx.de/pipermail/u-boot/2026-May/617853.html",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://u-boot.org/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/u-boot-rc3-buffer-overflow-in-nfs-readlink-reply-via-nfs-readlink",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}