CVE-2026-29007: U-Boot TCP DOS Vulnerability

CVE-2026-29007 Overview

CVE-2026-29007 is an out-of-bounds read vulnerability in the U-Boot bootloader through version 2026.04-rc3. The flaw resides in tcp_rx_state_machine() located in net/tcp.c and is exposed when CONFIG_PROT_TCP is enabled. A remote attacker can craft a TCP packet whose Internet Protocol (IP) total length disagrees with the TCP data offset field. This mismatch causes tcp_parse_options() to read beyond the end of the received TCP segment. The read can corrupt connection state variables including rmt_win_scale and rmt_timestamp, disrupting TCP window calculations during network boot operations.

Critical Impact
Remote attackers on the same network path can trigger out-of-bounds memory reads in U-Boot's TCP stack, corrupting connection state and destabilizing network-boot flows without authentication.

Affected Products

U-Boot bootloader versions through 2026.04-rc3
Builds compiled with CONFIG_PROT_TCP enabled
Embedded devices and boards relying on U-Boot TCP network boot

Discovery Timeline

2026-07-08 - CVE-2026-29007 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-29007

Vulnerability Analysis

The defect is classified as an out-of-bounds read [CWE-125]. U-Boot's TCP receive state machine calls tcp_parse_options() to walk the options area of an incoming TCP header. The parser trusts the TCP data offset field to determine how many header bytes follow. It does not cross-check that value against the IP total length reported by the outer packet. An attacker can send a packet declaring an IP total length of 40 bytes while setting the TCP data offset to claim a 60-byte TCP header. The parser then reads 40 bytes past the actual end of the segment. Adjacent memory content can be interpreted as TCP options, silently overwriting fields such as rmt_win_scale and rmt_timestamp.

Root Cause

The root cause is missing input validation between two independent length fields in the packet. U-Boot's tcp_rx_state_machine() does not verify that data_offset * 4 fits within ip_total_length - ip_header_length before dereferencing option bytes. Because tcp_parse_options() iterates until the claimed header end, any oversized offset produces a linear read past the packet buffer.

Attack Vector

Exploitation requires only network reachability to a U-Boot instance actively using its TCP stack, typically during TFTP, HTTP, or netboot phases. No authentication or user interaction is needed. The attacker sends a single crafted TCP segment whose IP total length is short but whose TCP data offset is inflated. The primary observed impact is availability: corrupted window scale and timestamp values break the TCP session and can stall or crash the boot flow.

No public proof-of-concept code is available. For the packet construction details, see the VulnCheck Advisory on U-Boot and the U-Boot Mailing List Update.

Detection Methods for CVE-2026-29007

Indicators of Compromise

TCP segments where the IP total length is smaller than the value implied by the TCP data offset field.
Repeated TCP resets, retransmissions, or aborted TFTP/HTTP boot sessions originating from devices running U-Boot.
Unexpected boot failures or hangs on embedded devices during network provisioning.

Detection Strategies

Deploy network intrusion detection signatures that flag TCP packets whose data_offset * 4 exceeds ip.len - ip.ihl * 4.
Inspect boot-time serial console logs for anomalous TCP behavior, dropped connections, or parser warnings from net/tcp.c.
Correlate malformed TCP traffic captured at the switch mirror port with boot-cycle events on managed embedded assets.

Monitoring Recommendations

Baseline the TCP traffic profile of PXE, TFTP, and HTTP boot servers and alert on segments with inconsistent header length fields.
Log and retain packet captures for any provisioning VLAN so post-incident analysis can reconstruct malformed segments.
Track U-Boot firmware versions across the fleet and alert when devices running 2026.04-rc3 or earlier appear on production networks.

How to Mitigate CVE-2026-29007

Immediate Actions Required

Inventory all devices running U-Boot builds that enable CONFIG_PROT_TCP and prioritize network-attached embedded systems.
Restrict boot and provisioning networks to trusted hosts using VLAN segmentation and layer-2 filtering.
Disable U-Boot TCP support where it is not required by rebuilding firmware without CONFIG_PROT_TCP.

Patch Information

At publication, no official fixed release version is listed in the NVD entry. Track the upstream fix through the U-Boot Mailing List Update and the U-Boot Official Website. Rebuild and reflash affected devices once a patched release addressing tcp_rx_state_machine() and tcp_parse_options() bounds validation is available.

Workarounds

Rebuild U-Boot with CONFIG_PROT_TCP disabled and fall back to UDP-based TFTP for network boot when feasible.
Isolate netboot infrastructure on a dedicated, access-controlled management network to remove untrusted senders.
Apply access control lists on upstream switches to drop TCP packets destined for U-Boot listeners from unauthorized sources.

bash

# Configuration example: disable TCP protocol support in U-Boot build config
scripts/config --file .config -d CONFIG_PROT_TCP
make olddefconfig
make -j$(nproc)