CVE-2026-29007

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.04-rc4

Description An out-of-bounds read occurs in the tcp rx state machine() function (net/tcp.c) when CONFIG PROT TCP is enabled. A remote attacker can read beyond TCP segment boundaries by sending a malicious packet where the IP total length and the TCP data offset field are mismatched. For example, providing an IP total length of 40 bytes and a TCP data offset of 60 bytes causes the tcp parse options() function to read 40 bytes past the end of the TCP segment. This can lead to the corruption of connection state variables, such as rmt win scale and rmt timestamp, which disrupts TCP window calculations.

Recommendations Update to a version later than 2026.04-rc3. As a temporary mitigation, disable the CONFIG PROT TCP configuration.