CVE-2026-71971 in U-Boot
Summary
by MITRE • 09/30/2026
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The Universal Boot Loader, commonly known as U-Boot, serves as a critical firmware component responsible for initializing hardware and loading operating system kernels in embedded systems and IoT devices. A significant security flaw has been identified within versions of U-Boot prior to 2026.10-rc3 when the configuration option CONFIG_IP_DEFRAG is enabled. This vulnerability manifests as an out-of-bounds write condition located specifically within the __net_defragment() function found in the net/net.c source file. The root cause lies in insufficient validation of IP fragment headers during the reassembly process, allowing a remote attacker to manipulate memory boundaries through carefully crafted network packets.
The technical mechanism of this vulnerability relies on the behavior of Internet Protocol fragmentation. When an IP packet is too large for transmission over a specific link layer, it may be split into multiple fragments. The __net_defragment() function attempts to reassemble these fragments back into a single coherent payload before passing it to higher-level protocols or bootloaders. However, under certain conditions involving crafted packets with non-zero offsets and the More-Fragments flag set, the logic governing buffer allocation and data copying fails to account for boundary constraints correctly. This oversight permits an attacker to write data beyond the allocated memory region associated with the defragmentation buffer.
Exploitation of this flaw requires a remote adversary positioned on the same network segment as the target device during its boot sequence. By sending specifically crafted IP fragments that trigger the defective code path, an attacker can corrupt adjacent memory structures within the U-Boot environment. This memory corruption typically results in immediate system instability, leading to a denial-of-service condition where the bootloader crashes or hangs. In more complex scenarios involving precise control over the overwritten data and subsequent execution flow, this vulnerability could potentially be leveraged for arbitrary code execution, although the primary observed impact is system crash due to stack or heap corruption within the firmware environment.
From an industry standard perspective, this issue aligns with CWE-787: Out-of-bounds Write, which describes writing data outside the bounds of a buffer. The attack vector corresponds to ATT&CK technique T1496: Resource Hijacking, as it disrupts service availability by crashing critical infrastructure components. Furthermore, because the vulnerability is triggered via network traffic during boot, it highlights risks associated with insecure default configurations and insufficient input validation in embedded firmware networking stacks.
Mitigation strategies primarily involve updating U-Boot to version 2026.10-rc3 or later, where this logic error has been addressed by developers through improved bounds checking and buffer management protocols. For environments where immediate patching is not feasible, administrators should consider disabling the CONFIG_IP_DEFRAG configuration option if IP defragmentation functionality is not strictly required for their specific boot process requirements. Additionally, implementing network segmentation to restrict access to devices during their critical initialization phases can reduce the attack surface available to potential adversaries seeking to exploit this vulnerability.