critical

CVE-2026-29009

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in ...

Published 8 Jul 2026Modified 24 Oct 2026CWE 120

In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD.

Description

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

Affected packages and fixed versions

Source	Package	Fixed in
debian 11	u-boot	no fix listed
debian 12	u-boot	no fix listed
debian 13	u-boot	no fix listed
debian 14	u-boot	no fix listed
echo	u-boot	no fix listed
rapidfort alpine 3.20	u-boot	2026.07-r0
rapidfort alpine 3.21	u-boot	2026.07-r0
rapidfort alpine 3.22	u-boot	2026.07-r0
rapidfort alpine 3.23	u-boot	2026.07-r0
rapidfort alpine 3.24	u-boot	2026.07-r0
rapidfort debian 12	u-boot	no fix listed
rapidfort debian 13	u-boot	no fix listed

References

What Attestkeep does with this

Inside your cluster, without you opening a spreadsheet.

KnowsThe scanner refreshes its vulnerability database every six hours.

FindsEvery admitted image is rescanned every 24 hours by default (scan.rescanInterval). When Trivy rates this vulnerability critical for the image's package source, it appears in the image's findings by name. Findings without a fix are left out unless includeUnfixed is on.

Tells youA critical_finding event goes to the channels subscribed to it: e-mail, Slack, Teams, a webhook, Jira, GitLab or GitHub.

RefusesWith a policy that blocks critical findings, a pod with this image is refused at admission, a rollback to it included. Pods already running are not evicted.

RecordsEach decision is recorded with the policy that ran and its hash, then sealed under a signed checkpoint.

Try Attestkeep

Read the docs