U-Boot up to 2026.04-rc3 TCP State Machine net/tcp.c tcp_parse_options data offset out-of-bounds

Summaryinfo

A vulnerability marked as very critical has been reported in U-Boot up to 2026.04-rc3. This issue affects the function tcp_parse_options of the file net/tcp.c of the component TCP State Machine. The manipulation of the argument data offset leads to out-of-bounds. This vulnerability is traded as CVE-2026-29007. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in U-Boot up to 2026.04-rc3. It has been rated as very critical. This issue affects the function tcp_parse_options of the file net/tcp.c of the component TCP State Machine. The manipulation of the argument data offset with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.

It is possible to read the advisory at lists.denx.de. The identification of this vulnerability is CVE-2026-29007 since 03/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/08/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• U-Boot

Version

• 2026.04-rc1
• 2026.04-rc2
• 2026.04-rc3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion