CVE-2026-29007 U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c

Medium 6.9 Published 8 Jul 2026 Updated 14 Jul 2026

Remote attackers can read memory beyond TCP segment boundaries in U-Boot, potentially corrupting connection state and disrupting TCP operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-29007?

CVE-2026-29007 is a medium-severity vulnerability in u-boot, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.

Weakness: CWE-125

Which versions are affected by CVE-2026-29007?

It affects 1 product.

Products include Denx U-Boot.

How do I fix CVE-2026-29007?

No fix has been published for CVE-2026-29007 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-29007 being exploited?

There is no known exploitation of CVE-2026-29007 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-29007, GHSA-572m-4pr8-48pj, UBUNTU-CVE-2026-29007.