CVE-2026-71971: U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
Vulnerability summary
CVE-2026-71971 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in u-boot. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 29-09-2026PublishedVulnerability first disclosed.
- 30-09-2026Last modifiedVulnerability information updated.
Description
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.
CVSS metrics
7 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- u-boot< 2016.01+dfsg1-2ubuntu5+esm1 | < 2020.10+dfsg-1ubuntu0~18.04.3+esm1 | < 2021.01+dfsg-3ubuntu0~20.04.6+esm1 | < 2022.01+dfsg-2ubuntu2.8 | < 2025.10-0ubuntu0.24.04.3 | < 2025.10-0ubuntu5 | < 2025.10-0ubuntu2.1
- u-boot-nezhaAll versions (No fix recorded)
Debian1 product
- u-bootAll versions (No fix recorded)
U-boot1 product
- u-boot< 2026.10-rc3
3 vendors · 4 products
References
8 links- www.vulncheck.com/advisories/u-boot-before-2026.10-rc3-out-of-bounds-write-in-ip-fragment-reassemblyThird Party AdvisoryREPORT
