CVE-2026-74225
Canonical Ubuntu Linux: out-of-bounds write can lead to denial of service
- Risk score
- 50/100
- CVSS
- 7.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
- Affected
- Canonical Ubuntu Linux before 2026.10
- Fix
- Upgrade Canonical Ubuntu Linux to 2026.10 or later.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
The flaws
- CVE-2026-74225: Out-of-bounds write can lead to denial of service (CVSS 7.1 · EPSS 0%)
- CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Canonical Ubuntu Linux: 2026.10 · 6.5.9 or later on your release line
Who is exposed: Canonical Ubuntu Linux before 2026.10
Where it stands
- No known exploitation
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
- 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities
Connects to
- Same weakness: Out-of-bounds write (CWE-787). 261 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 15 in the last 90 days
Why it is Yellow
- CVSS 7.1 high
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8930-2
- https://github.com/u-boot/u-boot
- https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
- https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
- https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6
Original description
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
Last activity 21 Oct 2026. Patch Forecast updates every hour.