CVE-2026-29007— U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1498 · Network Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-29007
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
Source: CVE Program / CVE List V5
Vulnerability Description
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
U-Boot 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
U-Boot U-Boot是U-Boot社区开源的一个免费、开源且可扩展的引导加载程序，适用于多种架构（ARM、MIPS、PowerPC、RISC-V、x86、x86_64），其目的是执行各种硬件初始化任务并启动设备的操作系统内核。 U-Boot 2026.04-rc3版本及之前版本存在缓冲区错误漏洞，该漏洞源于tcp_rx_state_machine()函数存在越界读取漏洞，允许远程攻击者通过发送IP总长度和TCP数据偏移字段不匹配的恶意数据包，读取TCP段边界之外的数据，可能破坏连接状态变量并扰乱TC
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-29007
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-29007
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-29007 (1)
Mailing List Discussions for CVE-2026-29007 (1)
Security Blog Posts for CVE-2026-29007 (1)
Vendor Pages for CVE-2026-29007 (1)
Same Patch Batch · u-boot · 2026-07-08 · 3 CVEs total
| CVE-2026-29009 | 8.2 HIGH | U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK |
| CVE-2026-29008 | 7.5 HIGH | U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine() |
IV. Related Vulnerabilities
Same product: u-boot
- CVE-2026-29009
U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() - CVE-2026-29008
U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_ma - CVE-2026-46728
DENX Software Engineering Das U-Boot 访问控制错误漏洞 - CVE-2024-57257
DENX Software Engineering Das U-Boot 安全漏洞 - CVE-2024-57256
DENX Software Engineering Das U-Boot 安全漏洞
Same weakness: CWE-125
- CVE-2026-66337
Libsoup: libsoup: heap buffer over-read via integer underflo - CVE-2026-66034
libssh2 Heap Out-of-Bounds Read via publickey subsystem - CVE-2026-55732
Loytec LINX firmware: Out-of-bounds Read in BACnet packet pa - CVE-2026-56391
Out‑of‑bounds Read in GNU coreutils - CVE-2026-16002
Out-of-bounds Read in MZ Automation lib60870
V. Comments for CVE-2026-29007
No comments yet