u-boot - Debian Package Tracker

general

source: u-boot (main)
version: 2025.01-3.2
maintainer: Vagrant Cascadian (DMD)
uploaders: Loïc Minier [DMD] – Clint Adams [DMD]
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2021.01+dfsg-5
o-o-sec: 2021.01+dfsg-5+deb11u3
oldstable: 2023.01+dfsg-2+deb12u3
old-sec: 2023.01+dfsg-2+deb12u3
old-p-u: 2023.01+dfsg-2+deb12u3
stable: 2025.01-3
stable-p-u: 2025.01-3+deb13u1
testing: 2025.01-3.2
unstable: 2025.01-3.2

versioned links

2021.01+dfsg-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2021.01+dfsg-5+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2023.01+dfsg-2+deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2025.01-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2025.01-3+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2025.01-3.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

u-boot (6 bugs: 1, 3, 2, 0)
u-boot-amlogic-binaries
u-boot-asahi (1 bugs: 0, 0, 1, 0)
u-boot-exynos (5 bugs: 0, 5, 0, 0)
u-boot-exynos-binaries
u-boot-imx (1 bugs: 0, 0, 1, 0)
u-boot-mvebu
u-boot-omap (2 bugs: 0, 2, 0, 0)
u-boot-qcom
u-boot-qemu (4 bugs: 0, 4, 0, 0)
u-boot-rockchip (2 bugs: 0, 1, 1, 0)
u-boot-rpi (3 bugs: 0, 2, 1, 0)
u-boot-sifive
u-boot-sitara-binaries
u-boot-starfive
u-boot-stm32
u-boot-sunxi (12 bugs: 1, 7, 4, 0)
u-boot-tegra
u-boot-tools (4 bugs: 0, 2, 2, 0)

action needed

A new upstream version is available: 2026.07 high

A new upstream version 2026.07 is available, you should consider packaging it.

Created: 2025-11-27 Last update: 2026-07-20 18:30

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2026-29007: U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
CVE-2026-29008: U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
CVE-2026-29009: U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.

2 issues that should be fixed with the next stable update:

CVE-2024-42040: Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.
CVE-2026-46728: Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.