A high-severity buffer overflow vulnerability in U-Boot allows unauthenticated attackers to cause system instability or potential code execution via malformed NFS responses.

The vulnerability is caused by a buffer copy operation that lacks adequate size checking when processing NFS readlink replies. An unauthenticated attacker can exploit this during the boot or network initialization process to cause a buffer overflow.

Successful exploitation can lead to a crash of the bootloader, resulting in a denial-of-service (DoS) and rendering the system unbootable. In more severe scenarios, the overflow could be leveraged for arbitrary code execution during the early boot stages, compromising the entire device security chain. Given the CVSS score of 8.2, this represents a significant threat to embedded device availability and security.

Immediate Action: Update U-Boot to a version beyond 2026.04-rc3 that includes the fix for the NFS readlink buffer overflow.

Proactive Monitoring: Monitor network traffic for anomalous NFS traffic directed at devices running U-Boot, particularly during the network boot sequence.

Compensating Controls: Restrict network access to devices using PXE or NFS booting to trusted, internal management segments to reduce the attack surface.

Public Exploit Available: false

Embedded systems using U-Boot for network booting are at risk until the patch is applied. Firmware maintainers must prioritize updating the bootloader to mitigate the risk of remote DoS or unauthorized code execution during the boot phase.