CVE-2026-29009

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29009
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29009.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29009
Downstream
Published
2026-07-08T16:16:04.460Z
Modified
2026-07-27T03:56:41.157401338Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK
Details

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfsreadlinkreply() (net/nfs-common.c) when CONFIGCMDNFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfspathbuff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfsserverip, nfsservermountport, nfsserverport, nfsourport, nfsstate, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29009.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-120"
    ]
}
References

Affected packages

Git / github.com/u-boot/u-boot

Affected ranges

Type
GIT
Repo
https://github.com/u-boot/u-boot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
88dc2788777babfd6322fa655df549a019aa1e69
Introduced
aa4f687977a449686498236722ee5e93d8b39918
Last affected
4f70106beafe30df8b0528a3d8b2543cd48fe241
Database specific 
{
    "cpe": [
        "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:denx:u-boot:2026.04:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:denx:u-boot:2026.04:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:denx:u-boot:2026.04:rc3:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.04"
        },
        {
            "introduced": "2026.04-rc1"
        },
        {
            "last_affected": "2026.04-rc1"
        },
        {
            "introduced": "2026.04-rc2"
        },
        {
            "last_affected": "2026.04-rc2"
        },
        {
            "introduced": "2026.04-rc3"
        },
        {
            "last_affected": "2026.04-rc3"
        }
    ]
}

Affected versions

2026.*
2026.04-rc1
2026.04-rc2
2026.04-rc3
v2026.*
v2026.04-rc1
v2026.04-rc2
v2026.04-rc3
v2026.04-rc4
v2026.04-rc5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29009.json"