Loading story…
A high-severity flaw tracked as CVE-2026-29008 affects U-Boot through version 2026.04-rc3, allowing a network-adjacent attacker to crash the bootloader with a malformed TCP SYN+ACK packet. The bug is an integer underflow in tcp_rx_state_machine() in net/tcp.c, where a manipulated TCP data offset can make payload_len negative before it is later treated as a large unsigned integer.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-29008, was added for the U-Boot integer underflow vulnerability affecting versions through 2026.04-rc3. The record identifies the issue as CWE-191 and notes denial-of-service impact from a malformed TCP SYN+ACK packet, with possible memory corruption in some configurations.
VulnCheck published an advisory describing an integer underflow vulnerability in U-Boot through version 2026.04-rc3. The flaw in tcp_rx_state_machine() can be triggered by a malformed TCP SYN+ACK packet, causing a bootloader crash and potentially memory corruption when CONFIG_LMB is disabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity flaw tracked as **CVE-2026-29009** affects **U-Boot through `2026.04-rc3`** in the `nfs_readlink_reply()` function within `net/nfs-common.c`. The vulnerability is present when `CONFIG_CMD_NFS` is enabled and stems from missing cumulative length validation while appending multiple relative symlink targets returned by an NFS server during `READLINK` handling. A malicious or compromised NFS server can trigger the bug by sending two or more `READLINK` responses with symlink targets of about 1100 bytes each, overflowing the 2048-byte `nfs_path_buff` buffer. The overflow can corrupt adjacent BSS variables including `nfs_server_ip`, `nfs_server_mount_port`, `nfs_server_port`, `nfs_our_port`, `nfs_state`, and `rpc_id`, creating a path to memory corruption and possible attacker control over the U-Boot NFS client state machine.
Jul 8, 2026
CERT Polska disclosed `CVE-2026-15390`, an out-of-bounds write in DENX Software Engineering's Das U-Boot bootloader affecting releases from 2009.08 through 2026.07. Builds configured with `CONFIG_IP_DEFRAG=y` fail to clear IP reassembly state after delivering a complete datagram, allowing an attacker who can send fragmented IP traffic to reuse duplicate final fragments and potentially achieve arbitrary code execution. Mateusz Furdyna of Nokia responsibly reported the flaw, with CERT Polska coordinating disclosure. The vulnerability was fixed in commit `b1aec609bb5e0d08c25c888c91935287ab4ee5fa`, included in Das U-Boot release 2026.07; organizations using affected network-enabled bootloader builds should verify the incorporated fix and update where necessary.
Sep 30, 2026
**CVE-2024-26826** is a moderate-severity Linux kernel flaw in Multipath TCP (MPTCP) that can cause unacknowledged data to be lost when a subflow becomes stale. An invalid optimization invoked a TCP-specific retransmission-queue helper on an MPTCP socket; following a TCP fast-path variable reorganization, the check could skip required data reinjection, creating a denial-of-service condition through lost retransmitted packets. The defect was introduced in kernel version 5.15. The issue is fixed in stable kernels `5.15.149`, `6.1.79`, `6.6.18`, `6.7.6`, and `6.8` and later. Red Hat rated the vulnerability CVSS 3.1 **5.5** (moderate), citing local low-complexity exploitation with low privileges and high availability impact, and released updated kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems; RHEL 6 is not affected. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026