CVE-2025-70290: n/a

An integer overflow vulnerability exists in the ZFS filesystem support of Denx U-Boot versions prior to 2026.04. The vulnerability is triggered by malformed on-disk metadata, which causes incorrect memory allocation. This leads to out-of-bounds memory access, potentially resulting in a crash or arbitrary code execution during system boot. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can cause denial of service via system crash or allow arbitrary code execution during the boot process, compromising system integrity and availability. The vulnerability affects the bootloader, a critical component in system startup, increasing the risk of persistent compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Denx U-Boot communications for patches or updates addressing this vulnerability. Until a fix is available, avoid using untrusted ZFS on-disk metadata with affected U-Boot versions.