CVE-2026-74225
Publication date 29 September 2026
Last updated 14 October 2026
Ubuntu priority
Description
U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| u-boot | 26.04 LTS resolute |
Fixed 2025.10-0ubuntu2.2
|
| 24.04 LTS noble |
Fixed 2025.10-0ubuntu0.24.04.4
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| u-boot-nezha | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
7.1 · High
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Base score
7.1 · High
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8930-1
- U-Boot vulnerabilities
- 14 October 2026
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-74225
- https://github.com/u-boot/u-boot
- https://github.com/u-boot/u-boot/blob/v2026.07/net/dhcpv6.c#L304
- https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
- https://www.vulncheck.com/advisories/u-boot-before-2026.10-rc5-out-of-bounds-write-via-dhcpv6