CVE-2026-74220
Canonical Ubuntu Linux: denial of service
- Risk score
- 64/100
- CVSS
- 8.2 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, cr…
- Affected
- Canonical Ubuntu Linux before 2026.10
- Fix
- Upgrade Canonical Ubuntu Linux to 2026.10 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
The flaws
- CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-74222: Use-after-free can lead to denial of service (CVSS 8.2 · EPSS 0%)
The fix
Upgrade Canonical Ubuntu Linux: 2026.10 · 6.5.9 or later on your release line
Who is exposed: Canonical Ubuntu Linux before 2026.10
Where it stands
- No known exploitation
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
- 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities
Connects to
- Same weakness: CWE-195 (CWE-195). 3 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 15 in the last 90 days
Why it is Amber
- CVSS 8.2 high
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8930-2
- https://github.com/u-boot/u-boot
- https://github.com/u-boot/u-boot/blob/v2026.07/net/nfs-common.c#L695
- https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a
- https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-buffer-overflow-via-nfs-read-reply
Original description
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.
Last activity 21 Oct 2026. Patch Forecast updates every hour.