CVE-2026-29007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29007
Downstream
Published
2026-07-08T16:11:25.888Z
Modified
2026-08-12T03:51:44.256836992Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
Details

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcprxstatemachine() (net/tcp.c) when CONFIGPROTTCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcpparseoptions() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmtwinscale and rmttimestamp to disrupt TCP window calculations.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29007.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ]
}
References

Affected packages

Git / github.com/u-boot/u-boot

Affected ranges

Type
GIT
Repo
https://github.com/u-boot/u-boot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
88dc2788777babfd6322fa655df549a019aa1e69
Introduced
aa4f687977a449686498236722ee5e93d8b39918
Last affected
4f70106beafe30df8b0528a3d8b2543cd48fe241
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.04"
        },
        {
            "introduced": "2026.04-rc1"
        },
        {
            "last_affected": "2026.04-rc1"
        },
        {
            "introduced": "2026.04-rc2"
        },
        {
            "last_affected": "2026.04-rc2"
        },
        {
            "introduced": "2026.04-rc3"
        },
        {
            "last_affected": "2026.04-rc3"
        }
    ],
    "cpe": [
        "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:denx:u-boot:2026.04:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:denx:u-boot:2026.04:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:denx:u-boot:2026.04:rc3:*:*:*:*:*:*"
    ]
}

Affected versions

2026.*
2026.04-rc1
2026.04-rc2
2026.04-rc3
v2026.*
v2026.04-rc1
v2026.04-rc2
v2026.04-rc3
v2026.04-rc4
v2026.04-rc5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29007.json"