USN-8884-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8884-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8884-1
Upstream
CVE (4)
Related
UBUNTU (4)
Published
2026-10-06T16:09:02Z
Modified
2026-10-07T04:41:44Z
Summary
u-boot vulnerabilities
Details

Timo Preißl discovered that U-Boot incorrectly handled certain malformed ZFS file system metadata. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. (CVE-2025-70290)

Timo Preißl discovered that U-Boot incorrectly calculated buffer sizes when processing certain ext4 file systems. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2025-70293)

Mateusz Furdyna discovered that U-Boot incorrectly handled certain fragmented IP traffic when IP defragmentation was enabled. An attacker could possibly use this issue to corrupt memory by sending crafted IP fragments, resulting in arbitrary code execution. (CVE-2026-15390)

Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain fragmented IP traffic during network boot when IP defragmentation was enabled. An attacker could possibly use this issue to trigger an out-of-bounds write, resulting in a denial of service. (CVE-2026-71971)

References

Affected packages

Ubuntu:22.04:LTS
u-boot

Package

Name
u-boot
Purl
pkg:deb/ubuntu/u-boot?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2022.01+dfsg-2ubuntu2.8

Affected versions

2021.*
2021.07+dfsg-0ubuntu8
2021.07+dfsg-0ubuntu9
2021.07+dfsg-0ubuntu10
2022.*
2022.01+dfsg-2ubuntu1
2022.01+dfsg-2ubuntu2
2022.01+dfsg-2ubuntu2.1
2022.01+dfsg-2ubuntu2.3
2022.01+dfsg-2ubuntu2.4
2022.01+dfsg-2ubuntu2.5
2022.01+dfsg-2ubuntu2.6
2022.01+dfsg-2ubuntu2.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "u-boot",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-amlogic",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-exynos",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-imx",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-microchip",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-mvebu",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-omap",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-qcom",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-qemu",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-rockchip",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-rpi",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-sifive",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-sunxi",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-tegra",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        },
        {
            "binary_name": "u-boot-tools",
            "binary_version": "2022.01+dfsg-2ubuntu2.8"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2025-70290",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2025-70293",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-15390",
            "severity": [
                {
                    "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-71971",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json"
Ubuntu:24.04:LTS
u-boot

Package

Name
u-boot
Purl
pkg:deb/ubuntu/u-boot?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2025.10-0ubuntu0.24.04.3

Affected versions

2023.*
2023.07+dfsg-1ubuntu2
2024.*
2024.01+dfsg-1ubuntu1
2024.01+dfsg-1ubuntu2
2024.01+dfsg-1ubuntu3
2024.01+dfsg-1ubuntu4
2024.01+dfsg-1ubuntu5
2024.01+dfsg-1ubuntu5.1
2024.01+dfsg-1ubuntu5.2
2025.*
2025.01-0ubuntu0.24.04.1
2025.01-0ubuntu0.24.04.2
2025.10-0ubuntu0.24.04.1
2025.10-0ubuntu0.24.04.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "u-boot-amlogic",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-amlogic-binaries",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-asahi",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-exynos",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-exynos-binaries",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-imx",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-microchip",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-mvebu",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-omap",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-qcom",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-qemu",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-rockchip",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-rpi",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-sifive",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-sitara-binaries",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-starfive",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-stm32",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-sunxi",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-tegra",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        },
        {
            "binary_name": "u-boot-tools",
            "binary_version": "2025.10-0ubuntu0.24.04.3"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2025-70290",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2025-70293",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-15390",
            "severity": [
                {
                    "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-71971",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json"
Ubuntu:26.04:LTS
u-boot

Package

Name
u-boot
Purl
pkg:deb/ubuntu/u-boot?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2025.10-0ubuntu2.1

Affected versions

2025.*
2025.01-3ubuntu4
2025.10-0ubuntu1
2025.10-0ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "u-boot-amlogic",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-amlogic-binaries",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-asahi",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-exynos",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-exynos-binaries",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-imx",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-microchip",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-mvebu",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-omap",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-qcom",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-qemu",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-rockchip",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-rpi",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-sifive",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-sitara-binaries",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-starfive",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-stm32",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-sunxi",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-tegra",
            "binary_version": "2025.10-0ubuntu2.1"
        },
        {
            "binary_name": "u-boot-tools",
            "binary_version": "2025.10-0ubuntu2.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2025-70290",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2025-70293",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-15390",
            "severity": [
                {
                    "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-71971",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json"
Ubuntu:Pro:16.04:LTS
u-boot

Package

Name
u-boot
Purl
pkg:deb/ubuntu/u-boot?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2016.01+dfsg1-2ubuntu5+esm1

Affected versions

2015.*
2015.04+dfsg1-2ubuntu1
2015.10+dfsg1-2
2015.10+dfsg1-3
2015.10+dfsg1-4
2016.*
2016.01+dfsg1-1
2016.01+dfsg1-1ubuntu1
2016.01+dfsg1-2ubuntu1
2016.01+dfsg1-2ubuntu2
2016.01+dfsg1-2ubuntu3
2016.01+dfsg1-2ubuntu5

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "u-boot",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-exynos",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-imx",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-omap",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-rockchip",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-rpi",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-sunxi",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-tegra",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        },
        {
            "binary_name": "u-boot-tools",
            "binary_version": "2016.01+dfsg1-2ubuntu5+esm1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2025-70290",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-15390",
            "severity": [
                {
                    "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-71971",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json"
Ubuntu:Pro:18.04:LTS
u-boot

Package

Name
u-boot
Purl
pkg:deb/ubuntu/u-boot?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2020.10+dfsg-1ubuntu0~18.04.3+esm1

Affected versions

2016.*
2016.03+dfsg1-6ubuntu2
2018.*
2018.07~rc3+dfsg1-0ubuntu1~18.04.1
2018.07~rc3+dfsg1-0ubuntu2~18.04.1
2018.07~rc3+dfsg1-0ubuntu3~18.04.1
2019.*
2019.07+dfsg-1ubuntu4~18.04.1
2020.*
2020.10+dfsg-1ubuntu0~18.04.2
2020.10+dfsg-1ubuntu0~18.04.3

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "u-boot",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-amlogic",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-exynos",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-imx",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-mvebu",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-omap",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-qcom",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-qemu",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-rockchip",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-rpi",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-sunxi",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-tegra",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        },
        {
            "binary_name": "u-boot-tools",
            "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3+esm1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2025-70290",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2025-70293",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-15390",
            "severity": [
                {
                    "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-71971",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json"
Ubuntu:Pro:20.04:LTS
u-boot

Package

Name
u-boot
Purl
pkg:deb/ubuntu/u-boot?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2021.01+dfsg-3ubuntu0~20.04.6+esm1

Affected versions

2019.*
2019.07+dfsg-1ubuntu3
2019.07+dfsg-1ubuntu5
2019.07+dfsg-1ubuntu6
2020.*
2020.10+dfsg-1ubuntu0~20.04.2
2021.*
2021.01+dfsg-3ubuntu0~20.04.1
2021.01+dfsg-3ubuntu0~20.04.3
2021.01+dfsg-3ubuntu0~20.04.4
2021.01+dfsg-3ubuntu0~20.04.5
2021.01+dfsg-3ubuntu0~20.04.6

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "u-boot",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-amlogic",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-exynos",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-imx",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-mvebu",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-omap",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-qcom",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-qemu",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-rockchip",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-rpi",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-sifive",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-sunxi",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-tegra",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        },
        {
            "binary_name": "u-boot-tools",
            "binary_version": "2021.01+dfsg-3ubuntu0~20.04.6+esm1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [
        {
            "id": "CVE-2025-70290",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2025-70293",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-15390",
            "severity": [
                {
                    "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-71971",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
                    "type": "CVSS_V4"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8884-1.json"