Ubuntu 26.10 U-Boot update fixes NFS, HTTP and DHCPv6 vulnerabilities
Ubuntu 26.10 receives U-Boot security fixes for four CVEs including buffer overflow and use-after-free flaws in network boot components.
Summary
Ubuntu has issued USN-8930-2 to backport U-Boot security fixes to Ubuntu 26.10, following the original USN-8930-1 for earlier releases. The update addresses four vulnerabilities in network boot paths: buffer overflows in NFS response handling, a use-after-free in lwIP HTTP processing, and out-of-bounds memory access via malformed DHCPv6 options. Affected packages include u-boot-imx, u-boot-qemu, and u-boot-tools, all updated to version 2025.10-0ubuntu6.
Vulnerabilities fixed in this update
- CVE-2026-74220 / CVE-2026-74221: Buffer overflow in U-Boot's handling of NFS READ and NFS READLINK responses, potentially allowing denial of service or arbitrary code execution
- CVE-2026-74222: Use-after-free triggered by HTTP data storage failures in the lwIP network stack, leading to denial of service
- CVE-2026-74225: Out-of-bounds memory access from insufficient validation of DHCPv6 option lengths during network boot
- Fixed packages for Ubuntu 26.10: u-boot-imx, u-boot-qemu, u-boot-tools — all at version 2025.10-0ubuntu6
Why it matters
U-Boot is the de facto standard bootloader for embedded Linux systems, making these network-boot vulnerabilities relevant to ARM boards, IoT devices, and cloud VM instances that rely on netboot. The fixes close attack paths that could be reached before the operating system itself loads.
Original reference: ubuntu.com →