An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.

Affected: unknown

-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling Author: Timo Preißl <t.preissl () proton me> Date: 2026-02-11 CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293 Affected: Denx U-Boot <= v2026.01-rc4 Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot bootloader's filesystem handling code and command-line interface. These flaws can lead to heap memory under-allocation followed by heap-based buffer overflows, potentially allowing Arbitrary Code Execution (ACE) in the pre-boot environment.

== Vulnerability Details ==

--- CVE-2025-70290: ZFS Metadata Integer Overflow ---

Component: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist Impact: A crafted ZFS filesystem image with malformed on-disk metadata can trigger an integer overflow during the size calculation passed to calloc(), resulting in an undersized allocation and subsequent out-of-bounds memory access. Fix: Validation of allocation size using __builtin_add_overflow.

--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---

Component: fs/fs.c, function do_mv Impact: Missing length checks in the directory move command allow an integer overflow during string length addition. An attacker with U-Boot shell access can trigger an under-allocation, resulting in a heap buffer overflow via strcpy(). Fix: Safe addition of string lengths using compiler intrinsics.

--- CVE-2025-70292…

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.

Affected: Ubuntu:16.04:LTS: u-boot, Ubuntu:18.04:LTS: u-boot, Ubuntu:20.04:LTS: u-boot, Ubuntu:22.04:LTS: u-boot, Ubuntu:22.04:LTS: u-boot-nezha, Ubuntu:24.04:LTS: u-boot, Ubuntu:24.04:LTS: u-boot-nezha, Ubuntu:26.04:LTS: u-boot

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.