CVE-2026-74222

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.10-rc5

Description A use-after-free issue exists in the lwIP wget implementation. In the httpc recv cb() function, when HTTP data storage fails, the callback frees the connection PCB (Protocol Control Block) but returns ERR BUF instead of ERR ABRT. This leads the TCP input path to access memory that has already been released, resulting in a bootloader crash.

Recommendations Update to version 2026.10-rc5 or later.