CVE-2026-15390
Out-of-bounds write in Das U-Boot
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.
This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds write in Das U-Boot
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.
This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
CVE-2026-15390- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-787, CWE-459
- Updated
- 2026-11-02
EUVDEUVD-2026-88699
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.
This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
EUVD-2026-88699- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vm4x-pmjm-j3wm
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering...
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.
This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
GHSA-vm4x-pmjm-j3wm- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-459
- Updated
- 2026-11-02
NVD
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.
This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
CVE-2026-15390- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-459, CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-15390
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
DEBIAN-CVE-2026-15390- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-15390
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
UBUNTU-CVE-2026-15390- CVSS 4.0
- 9.0 Critical
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
OSVAZL-105729 No score
CVE-2026-15390 affecting package qemu 10.1.0-1
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.
This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.
- Record
AZL-105729- Updated
- 2026-11-02
OSVUSN-8884-1 No score
u-boot vulnerabilities
Timo Preißl discovered that U-Boot incorrectly handled certain malformed ZFS file system metadata. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. (CVE-2025-70290)
Timo Preißl discovered that U-Boot incorrectly calculated buffer sizes when processing certain ext4 file systems. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2025-70293)
Mateusz Furdyna discovered that U-Boot incorrectly handled certain fragmented IP traffic when IP defragmentation was enabled. An attacker could possibly use this issue to corrupt memory by sending crafted IP fragments, resulting in arbitrary code execution. (CVE-2026-15390)
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain fragmented IP traffic during network boot when IP defragmentation was enabled. An attacker could possibly use this issue to trigger an out-of-bounds write, resulting in a denial of service. (CVE-2026-71971)
- Record
USN-8884-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAzure Linux:3 |
through 10.1.0-1 | None known |
u-bootDebian:12 |
All versions, plus listed versions 2023.01+dfsg-22023.01+dfsg-2+deb12u12023.01+dfsg-2+deb12u22023.01+dfsg-2+deb12u32023.04+dfsg-1 Show 19 moreShow less2023.04~rc2+dfsg-12023.04~rc5+dfsg-12023.07+dfsg-12023.07~rc4+dfsg-12023.07~rc5+dfsg-12024.01+dfsg-12024.01+dfsg-22024.01+dfsg-32024.01+dfsg-42024.01+dfsg-52024.01+dfsg-62024.01+dfsg-72024.01~rc6+dfsg-12024.01~rc6+dfsg-22025.01-12025.01-22025.01-32025.01-3.12025.01-3.2 |
None known |
u-bootDebian:13 |
All versions, plus listed versions 2025.01-32025.01-3+deb13u12025.01-3.12025.01-3.2 |
None known |
u-bootDebian:14 |
All versions, plus listed versions 2025.01-32025.01-3.12025.01-3.2 |
None known |
u-bootUbuntu:Pro:16.04:LTS |
before 2016.01+dfsg1-2ubuntu5+esm1, plus listed versions 2015.04+dfsg1-2ubuntu12015.10+dfsg1-22015.10+dfsg1-32015.10+dfsg1-42016.01+dfsg1-1 Show 5 moreShow less2016.01+dfsg1-1ubuntu12016.01+dfsg1-2ubuntu12016.01+dfsg1-2ubuntu22016.01+dfsg1-2ubuntu32016.01+dfsg1-2ubuntu5 |
2016.01+dfsg1-2ubuntu5+esm1 |
u-bootUbuntu:Pro:18.04:LTS |
before 2020.10+dfsg-1ubuntu0~18.04.3+esm1, plus listed versions 2016.03+dfsg1-6ubuntu22018.07~rc3+dfsg1-0ubuntu1~18.04.12018.07~rc3+dfsg1-0ubuntu2~18.04.12018.07~rc3+dfsg1-0ubuntu3~18.04.12019.07+dfsg-1ubuntu4~18.04.12020.10+dfsg-1ubuntu0~18.04.22020.10+dfsg-1ubuntu0~18.04.3 |
2020.10+dfsg-1ubuntu0~18.04.3+esm1 |
u-bootUbuntu:Pro:20.04:LTS |
before 2021.01+dfsg-3ubuntu0~20.04.6+esm1, plus listed versions 2019.07+dfsg-1ubuntu32019.07+dfsg-1ubuntu52019.07+dfsg-1ubuntu62020.10+dfsg-1ubuntu0~20.04.22021.01+dfsg-3ubuntu0~20.04.1 Show 4 moreShow less2021.01+dfsg-3ubuntu0~20.04.32021.01+dfsg-3ubuntu0~20.04.42021.01+dfsg-3ubuntu0~20.04.52021.01+dfsg-3ubuntu0~20.04.6 |
2021.01+dfsg-3ubuntu0~20.04.6+esm1 |
u-bootUbuntu:22.04:LTS |
before 2022.01+dfsg-2ubuntu2.8, plus listed versions 2021.07+dfsg-0ubuntu82021.07+dfsg-0ubuntu92021.07+dfsg-0ubuntu102022.01+dfsg-2ubuntu12022.01+dfsg-2ubuntu2 Show 6 moreShow less2022.01+dfsg-2ubuntu2.12022.01+dfsg-2ubuntu2.32022.01+dfsg-2ubuntu2.42022.01+dfsg-2ubuntu2.52022.01+dfsg-2ubuntu2.62022.01+dfsg-2ubuntu2.7 |
2022.01+dfsg-2ubuntu2.8 |
u-boot-nezhaUbuntu:22.04:LTS |
All versions, plus listed versions 2021.09+git20211008.62392d3-0ubuntu12022.04+git20220405.7446a472-0ubuntu0.12022.04+git20220405.7446a472-0ubuntu0.22022.04+git20220405.7446a472-0ubuntu0.32022.04+git20220405.7446a472-0ubuntu0.4 |
None known |
u-bootUbuntu:24.04:LTS |
before 2025.10-0ubuntu0.24.04.3, plus listed versions 2023.07+dfsg-1ubuntu22024.01+dfsg-1ubuntu12024.01+dfsg-1ubuntu22024.01+dfsg-1ubuntu32024.01+dfsg-1ubuntu4 Show 7 moreShow less2024.01+dfsg-1ubuntu52024.01+dfsg-1ubuntu5.12024.01+dfsg-1ubuntu5.22025.01-0ubuntu0.24.04.12025.01-0ubuntu0.24.04.22025.10-0ubuntu0.24.04.12025.10-0ubuntu0.24.04.2 |
2025.10-0ubuntu0.24.04.3 |
u-boot-nezhaUbuntu:24.04:LTS |
All versions, plus listed versions 2022.10-1089-g528ae9bc6c-0ubuntu22024.01~rc1-190-g2e89b706f5-0ubuntu12024.01~rc1-190-g2e89b706f5-0ubuntu22024.01~rc1-190-g2e89b706f5-0ubuntu2.24.04.2 |
None known |
u-bootUbuntu:26.10 |
before 2025.10-0ubuntu5, plus listed versions 2025.10-0ubuntu22025.10-0ubuntu32025.10-0ubuntu4 |
2025.10-0ubuntu5 |
u-bootUbuntu:26.04:LTS |
before 2025.10-0ubuntu2.1, plus listed versions 2025.01-3ubuntu42025.10-0ubuntu12025.10-0ubuntu2 |
2025.10-0ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-15390 is a critical vulnerability (CVSS 9.0) in Denx Software Engineering Das U-boot, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in u-boot 2016.01+dfsg1-2ubuntu5+esm1.