CVE-2026-29007
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedU-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceU-Boot through 2026.04-rc3 contains an out-of-bounds read in tcp_parse_options() called from tcp_rx_state_machine() in net/tcp.c when CONFIG_PROT_TCP is enabled. By sending a packet with IP total length (40 bytes) smaller than the TCP data offset (claiming 60 bytes), attackers read 40 bytes past the TCP segment end, corrupting rmt_win_scale and rmt_timestamp state variables.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2026.04= 2026.04CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Verify CONFIG_PROT_TCP is enabledInspect the U-Boot configuration file (.config) or build settings for the line CONFIG_PROT_TCP=y. If present, the vulnerability applies. If CONFIG_PROT_TCP is not defined or set to n, the code path is not present and the system is not affected.Affected if CONFIG_PROT_TCP is enabled in the U-Boot build configuration
-
Confirm the U-Boot versionRun the command 'version' or 'bootz' at the U-Boot prompt to display the installed U-Boot version string. Compare this version against any official security advisories listing affected versions for CVE-2026-29007.Affected if The installed version falls within the range of versions known to contain the vulnerable tcp_parse_options() code in net/tcp.c
-
Determine if TCP networking is in useCheck the device boot configuration, network scripts, or runtime environment to see if the U-Boot network stack processes TCP traffic (e.g., via tftpboot, NFS, or other TCP-based protocols). Inspect network boot parameters or configuration files.Affected if The device uses TCP-based network protocols or has CONFIG_PROT_TCP used at runtime for network communication
-
Inspect the net/tcp.c source or binaryIf source is available, examine the tcp_parse_options() function in net/tcp.c for bounds checking on the tcp_data_offset field relative to ip_data_len. If only the binary is available, use disassassembly tools to check if the function contains proper bounds validation before memory reads.Affected if The tcp_parse_options() function lacks or has insufficient validation of the TCP data offset against the actual packet length, allowing out-of-bounds reads
A system is affected if it runs a U-Boot build with CONFIG_PROT_TCP enabled, uses a version containing the vulnerable code, and processes network traffic where malicious TCP packets could be received.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped2026.04
Apply a bounds check in tcp_parse_options() to validate that TCP header length does not exceed the actual packet size derived from IP total length before parsing options. If unused, disable CONFIG_PROT_TCP to eliminate the attack surface.
U-Boot 2026.05 or later stable release (or patched 2026.04 stable)
- 1. Identify all U-Boot builds that have CONFIG_PROT_TCP enabled in their configuration
- 2. Download the fixed U-Boot release (version 2026.05 or later, or the patched 2026.04 stable release if available) from the official U-Boot repository at https://source.denx.de/u-boot/u-boot/-/releases
- 3. Rebuild U-Boot for your specific target platform with the fixed version source
- 4. Replace the vulnerable U-Boot binary/image on affected devices
- 5. Verify the new image includes the fix for the tcp_parse_options() out-of-bounds read (commits addressing the IP total length/TCP data offset mismatch)
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation5.0 h
- Implementation8.0 h
- Testing10.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,168.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-29007 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-29007 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data