CVE-2025-70290: Denx U-Boot ZFS RCE Vulnerability

CVE-2025-70290 Overview

CVE-2025-70290 is an integer overflow vulnerability in Denx U-Boot versions before 2026.04. The flaw resides in the ZFS filesystem support code and is triggered by malformed on-disk metadata. When parsed, the overflow causes incorrect memory allocation followed by an out-of-bounds memory access. The result is a crash of the bootloader or arbitrary code execution during the boot process.

Because U-Boot executes before the operating system, exploitation directly impacts the pre-boot trust chain of embedded and IoT devices that rely on ZFS-formatted media.

Critical Impact
A malformed ZFS volume can crash U-Boot or execute attacker-controlled code during boot, compromising firmware integrity before the operating system starts.

Affected Products

Denx U-Boot versions prior to 2026.04
Embedded systems and IoT devices using U-Boot with ZFS filesystem support enabled
Bootloader deployments that read ZFS-formatted storage media

Discovery Timeline

2026-08-26 - CVE-2025-70290 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-70290

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in U-Boot's ZFS filesystem parsing logic. U-Boot supports reading ZFS volumes to load kernels and boot images. During metadata parsing, size or count fields from on-disk structures are used in arithmetic operations without adequate bounds checking.

When the arithmetic result wraps around, the allocator receives a value smaller than the memory actually required. Subsequent copy or read operations then walk past the end of the allocated buffer, producing an out-of-bounds access. Depending on the surrounding memory layout, this leads to a bootloader crash or corruption of adjacent structures that an attacker can leverage for code execution.

Root Cause

The root cause is unchecked arithmetic on attacker-controlled metadata fields inside the ZFS driver in U-Boot. Values read from disk are multiplied or added before allocation, and the intermediate result overflows the fixed-width integer type. The allocator then returns an undersized buffer, and the parser writes or reads beyond its bounds.

Attack Vector

An attacker crafts a ZFS image with malformed metadata and places it on storage the target device reads at boot. This can be an attached USB device, an SD card, an internal disk on a compromised host, or a network-provisioned image. When U-Boot mounts the ZFS volume, the malformed structures trigger the overflow.

The vulnerability manifests during metadata parsing before signature verification of the loaded payload. See the GitHub Gist code snippet and the U-Boot official site for additional technical context.

Detection Methods for CVE-2025-70290

Indicators of Compromise

Unexpected U-Boot resets, hangs, or exception messages during the boot sequence when a ZFS volume is present
ZFS images on removable media that were not provisioned through approved firmware update channels
Boot log entries referencing ZFS metadata parsing errors or memory faults

Detection Strategies

Inventory devices that ship U-Boot builds with ZFS filesystem support compiled in, then compare running versions against 2026.04 or later
Validate the integrity of ZFS images used for boot by comparing cryptographic hashes against known-good manifests
Monitor serial console output on managed embedded fleets for boot-time crashes correlated with ZFS mounts

Monitoring Recommendations

Collect and centralize U-Boot serial logs for embedded fleets to identify anomalous boot failures
Track firmware and bootloader versions in the asset inventory so newly disclosed U-Boot CVEs can be mapped to affected devices
Alert on physical port activity such as unexpected USB or SD insertions on unattended devices

How to Mitigate CVE-2025-70290

Immediate Actions Required

Upgrade U-Boot to version 2026.04 or later on all affected devices
Disable ZFS filesystem support in U-Boot builds where it is not required for boot
Restrict physical access to storage interfaces on devices that cannot be immediately patched

Patch Information

The issue is resolved in Denx U-Boot 2026.04. Rebuild affected firmware images against the patched source tree and deploy through the existing signed update mechanism. Verify that the ZFS driver in the resulting image includes the corrected bounds checks before promoting the build to production devices.

Workarounds

Remove CONFIG_FS_ZFS and related ZFS options from the U-Boot configuration when rebuilding firmware
Enforce secure boot and signed boot images so unauthorized ZFS volumes cannot be loaded automatically
Lock down boot order to trusted internal storage and disable boot from external USB or SD media

bash

# Configuration example: disable ZFS support in U-Boot before rebuilding
scripts/config --file .config --disable CONFIG_FS_ZFS
scripts/config --file .config --disable CONFIG_CMD_ZFS
make olddefconfig
make -j$(nproc)