U-Boot <=2026.10-rc5 NFS Readlink Buffer Overflow
CVE-2026-74221 Published on September 29, 2026
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
Vulnerability Analysis
CVE-2026-74221 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Signed to Unsigned Conversion Error
The software uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
Products Associated with CVE-2026-74221
stack.watch emails you whenever new vulnerabilities are published in Denx U Boot or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
u-boot:- Before 2026.10-rc5 is affected.