CVE-2026-29008

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.

• CWE-191

• https://lists.denx.de/pipermail/u-boot/2026-May/617853.htmlMailing List, Third Party Advisory
• https://u-boot.org/Product
• https://www.vulncheck.com/advisories/u-boot-rc3-integer-underflow-dos-via-tcp-rx-state-machineThird Party Advisory, Exploit
• https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/Third Party Advisory, Exploit

Published

Jul 8, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28999Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-2900GitLab has remediated an issue in GitLab EE affecting all ve…2.7
• CVE-2026-29000pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain …9.3
• CVE-2026-29002CouchCMS contains a privilege escalation vulnerability that …8.6
• CVE-2026-29004BusyBox before commit 42202bf contains a heap buffer overflo…8.1
• CVE-2026-29007U-Boot through 2026.04-rc3 contains an out-of-bounds read vu…6.9
• CVE-2026-29009U-Boot before 2026.07-rc2 contains a buffer overflow vulnera…9.8
• CVE-2026-29010Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29011Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29012Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29013libcoap contains out-of-bounds read vulnerabilities in OSCOR…9.8
• CVE-2026-29014MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenti…9.8