Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-07-08 | 2 | Disclosure2 |
| 2026-07-09 | 1 | Disclosure1 |
CVE-2026-29008: a single TCP SYN+ACK packet can crash U-Boot before your device finishes booting. Integer underflow in tcp_rx_state_machine(). Here's what broke and who's affected.
Post summary
The CVE reveals that a single TCP SYN+ACK packet can trigger an integer underflow in tcp_rx_state_machine(), crashing U‑Boot before boot completion.
🚨*CVE* CVE-2026-29008 U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to c… https://www.cve.org/CVERecord?id=CVE-2026-29008 ----- Traducción: CVE-2026-29008 U-B… http://infoflow.cloud`
Post summary
The tweet announces the CVE-2026-29008 vulnerability in U‑Boot, detailing an integer underflow in tcp_rx_state_machine(), with no mention of PoC, exploit code, active use, or patch.
CVE-2026-29008 U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to c… https://www.cve.org/CVERecord?id=CVE-2026-29008
Post summary
The message announces the discovery of an integer underflow vulnerability in U‑Boot and provides basic functional details, but no PoC, exploit code, or patch guidance.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | denx | u-boot | - | - | - |
| App | denx | u-boot | 2026.04 | - | - |
| App | denx | u-boot | 2026.04 | - | - |
| App | denx | u-boot | 2026.04 | - | - |