U-Boot: NFS client overflows nfs_path_buff on chained relative symlink replies, corrupting BSS state

Impact

With CONFIG_CMD_NFS enabled, nfs_readlink_reply() appends symlink targets into the 2048-byte nfs_path_buff without validating the cumulative length. An NFS server that answers two or more READLINK requests with relative targets of roughly 1100 bytes each overflows the buffer and corrupts adjacent BSS variables - nfs_server_ip, the mount and client port numbers, nfs_state and rpc_id - giving the server control over the NFS client state machine and the prospect of further memory corruption inside the bootloader. This matters where U-Boot is the boot firmware: ARM-based server boards, OpenBMC-style management controllers, and any node configured to netboot its kernel over NFS. Code that runs before the OS has no mitigations behind it, and the attacker position is the boot-time NFS server, which in a provisioning network is shared across many nodes. The record describes memory corruption and state-machine control, not a demonstrated code-execution chain.

Who can reach it

A malicious or already-compromised NFS server - or anyone who can impersonate one on the unauthenticated provisioning/management VLAN the node netboots over. No authentication is involved; the node has to be configured to use the U-Boot nfs command, and only nodes that netboot over NFS are reachable at all.

What to do

Update U-Boot to 2026.07-rc2 or later, or backport the linked fix commit, and reflash the bootloader - that means taking the node out of service, and on many boards a recovery path or serial console in case the flash goes wrong. If a flash campaign cannot be scheduled, the cheaper mitigations are to stop using NFS netboot (build without CONFIG_CMD_NFS, or boot over a path you control) and to make sure the provisioning network and its NFS server are not reachable by tenants.

References

Related entries

• AMD Zen 2 op cache: shared resources are not properly isolated, corrupting instructionsCVE-2026-46174 · AMD Zen 2 op cache (shared-resource isolation; Linux x86/CPU/AMD fix)High
• Linux kernel (drivers/infiniband/core): The RDMA user-capability check identified the capability file only by deviceCVE-2026-53188 · Linux kernel (drivers/infiniband/core)High
• Dell OpenManage Enterprise: authenticated low-privilege OS command injection on the management applianceCVE-2026-54795 · Dell OpenManage Enterprise (OS command injection)High
• Linux kernel mlx5_core IPsec offload / eswitch mode interlock: The acquire-SA path unconditionally callsCVE-2026-64522 · Linux kernel mlx5_core IPsec offload / eswitch mode interlockHigh
• Supermicro BMC: crafted RAKP+ messages escalate an IPMI account to administratorCVE-2026-65220 · Supermicro BMC (IPMI RAKP+ authentication logic)High
• MikroTik RouterOS: pre-auth btest session leaks kernel buffer data and can restart the deviceCVE-2026-67277 · MikroTik RouterOS (btest bandwidth test service)High