CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-29007

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.

Score
6.9 medium
Published
2026-07-08
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
sysutils/u-boot-toolsu-boot-tools2025.10unaddresseduboot@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>u-boot-tools</name>
	<range><lt>2026.04</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>U-Boot through 2026.04-rc3 contains an out-of-bounds read
	vulnerability in tcp_rx_state_machine() (net/tcp.c) when
	CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond
	TCP segment boundaries by crafting a malicious packet with a
	mismatched IP total length and TCP data offset field. Attackers can
	send a packet with an IP total length of 40 bytes and a TCP data
	offset claiming 60 bytes of header to cause tcp_parse_options() to
	read 40 bytes past the end of the TCP segment, potentially corrupting
	connection state variables such as rmt_win_scale and rmt_timestamp to
	disrupt TCP window calculations.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-29007</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-29007</url>
    </references>
    <dates>
      <discovery>2026-07-08</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>