Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by CERT-PL

CVE-2026-15390Out-of-bounds write in Das U-Boot

Critical 9.0

In plain English

A critical-severity out-of-bounds write in Das U-Boot from DENX Software Engineering. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.0Critical
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12u-bootno fix listedDEBIAN-CVE-2026-15390
Debian:13u-bootno fix listedDEBIAN-CVE-2026-15390
Debian:14u-bootno fix listedDEBIAN-CVE-2026-15390
Ubuntu:22.04:LTSu-boot2022.01+dfsg-2ubuntu2.8USN-8884-1
Ubuntu:22.04:LTSu-boot2022.01+dfsg-2ubuntu2.8UBUNTU-CVE-2026-15390
Ubuntu:24.04:LTSu-boot2025.10-0ubuntu0.24.04.3UBUNTU-CVE-2026-15390
Ubuntu:24.04:LTSu-boot2025.10-0ubuntu0.24.04.3USN-8884-1
Ubuntu:26.04:LTSu-boot2025.10-0ubuntu2.1USN-8884-1
Ubuntu:26.04:LTSu-boot2025.10-0ubuntu2.1UBUNTU-CVE-2026-15390
Ubuntu:26.10u-boot2025.10-0ubuntu5UBUNTU-CVE-2026-15390
Ubuntu:22.04:LTSu-boot-nezhano fix listedUBUNTU-CVE-2026-15390
Ubuntu:24.04:LTSu-boot-nezhano fix listedUBUNTU-CVE-2026-15390

Affected products (as reported)

VendorProductVersions
DENX Software Engineering Das U-Boot 2009.08 – through 2026.07

Weakness: CWE-787, CWE-459 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References