CVE-2026-29009 is a high severity (CVSS 8.2) buffer overflow in U-Boot before 2026.07-rc2. When CONFIG_CMD_NFS is enabled, a malicious or compromised NFS server can overflow a 2048-byte buffer through repeated READLINK replies. Update to a build with the fix, or turn off NFS boot.
What's affected
The record says U-Boot before 2026.07-rc2 is affected, and the fix is in that release candidate. It applies only when CONFIG_CMD_NFS is enabled, and the flaw is in nfs_readlink_reply() in net/nfs-common.c.
The affected buffer is the 2048-byte nfs_path_buff. U-Boot is built into device firmware, so the version that matters is the one in your bootloader, not on a general purpose host.
How to check if you're exposed
From the U-Boot console, the version command prints the build. In your build tree, check whether the option is on:
grep CONFIG_CMD_NFS .config
If the option is off, this code is not built in. If it is on, compare your source with the 2026.07-rc2 changes.
What to do now
- Find which of your products ship U-Boot and which enable
CONFIG_CMD_NFS. - Update to U-Boot 2026.07-rc2 or later (a final 2026.07 or newer release when you can), or apply the upstream patch to your tree.
- If you do not need booting from NFS, disable the option.
- Use NFS only on trusted, isolated networks, and prefer verified boot so a rogue server cannot supply boot content.
- Plan firmware updates with your device vendor if you do not build U-Boot yourself.
Why it matters
This is CWE-120, a classic buffer copy without checking the size of the input. The code appended relative symlink targets into a fixed buffer without tracking the total length, so a server returning several long targets could write past the end.
The record says this can corrupt neighboring variables, including the NFS client's server IP, ports, state and RPC ID, which could let the attacker steer the client state machine. The attacker model is a malicious or compromised NFS server, which is why the practical defense is to keep NFS boot on trusted networks.
Bootloader bugs matter because they run before the operating system's protections exist. The record does not mark the CVE as exploited in the wild.
Quick check
Does this affect every device with U-Boot?
No. It needs CONFIG_CMD_NFS enabled, and the attacker needs to control the NFS server the device talks to.
Sources
Last reviewed: 19 October 2026.
