CVE-2026-29007 Details
Description
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
A out-of-bounds read vulnerability has been identified in U-Boot versions through 2026.04-rc3. The issue arises in the TCP reception state machine when the TCP protection feature is enabled. Remote attackers can exploit this vulnerability by sending crafted packets that manipulate the IP total length and TCP data offset. This exploitation allows the attacker to read data beyond the intended boundaries of the TCP segment, potentially corrupting critical connection state variables and disrupting TCP window management.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.denx.de/pipermail/u-boot/2026-May/617853.html | [email protected] | Mailing ListThird Party Advisory |
| https://u-boot.org/ | [email protected] | Product |
| https://www.vulncheck.com/advisories/u-boot-rc3-out-of-bounds-read-in-tcp-rx-state-machine-via-tcp-c | [email protected] | Third Party AdvisoryExploit |
| https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/ | [email protected] | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| denx u-boot | < 2026.04 2026.04 rc1 2026.04 rc2 2026.04 rc3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 13, 2026 | CVE Modified | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |