9

CVE-2026-15390: Out-of-bounds write in Das U-Boot

Awaiting analysis
AliasesUBUNTU-CVE-2026-15390DEBIAN-CVE-2026-15390
Published 29-09-2026Last modified 29-09-2026

Vulnerability summary

CVE-2026-15390 is a critical (CVSS 9.0) Incomplete Cleanup vulnerability in denx software engineering das u-boot. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 19.9% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.0/10
010
Critical · v4.0 (CVE.org)
EPSS score
0.29%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
USN-8884-1

Timeline

  1. 29-09-2026
    PublishedVulnerability first disclosed.
  2. 29-09-2026
    Last modifiedVulnerability information updated.

Description

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

20%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

30-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu2 products
  • u-boot< 2016.01+dfsg1-2ubuntu5+esm1 | < 2020.10+dfsg-1ubuntu0~18.04.3+esm1 | < 2021.01+dfsg-3ubuntu0~20.04.6+esm1 | < 2022.01+dfsg-2ubuntu2.8 | < 2025.10-0ubuntu0.24.04.3 | < 2025.10-0ubuntu5 | < 2025.10-0ubuntu2.1
  • u-boot-nezhaAll versions (No fix recorded)
Debian1 product
  • u-bootAll versions (No fix recorded)
Denx software engineering1 product

3 vendors · 4 products

References

6 links