Report an incident
Back
  • About us
  • For experts
Report an incident
About us
About our team Contact
Baza wiedzy
Fałszywe inwestycje Uważaj na fałszywe sklepy online (Nie)bezpieczne płatności Fałszywi konsultanci Zadbaj o bezpieczne hasła i logowanie Fałszywe załączniki w mailach Fałszywe prośby o szybki przelew Bezpieczny telefon
Biuletyn OUCH!
Porady bezpieczeństwa OUCH!
Tools
n6 Artemis MWDB
CVD program
CVD policy Advisories

Vulnerability in Das U-Boot software
29 September 2026 | CERT Polska | #vulnerability, #warning, #cve
CVE ID CVE-2026-15390
Publication date 29 September 2026
Vendor DENX Software Engineering
Product Das U-Boot
Vulnerable versions From 2009.08 through 2026.07
Vulnerability type (CWE) Out-of-bounds write (CWE-787)
Report source Report to CERT Polska

Description

CERT Polska has received a report about vulnerability in DENX Software Engineering Das U-Boot software and participated in coordination of its disclosure.

The vulnerability CVE-2026-15390: Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.

This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa included in release version 2026.07.

Credits

We thank Mateusz Furdyna from Nokia for the responsible vulnerability report.

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.