The vulnerability in U-Boot (up to 2026.04-rc3) is an integer underflow in the tcp_rx_state_machine() function located in net/tcp.c. When handling a TCP SYN+ACK packet with a crafted data offset field, the payload_len variable becomes negative. The TCP_SYN_SENT handler calls tcp_rx_user_data() without validating the segment window, allowing the negative payload_len to be implicitly converted to a large unsigned integer. This value is then passed to memcpy() in store_block(), causing a crash that prevents the device from booting. Additionally, if CONFIG_LMB is disabled, memory corruption may occur. This vulnerability can be triggered by a network-adjacent attacker without authentication or user interaction.

Exploitation causes an immediate crash of the U-Boot bootloader, preventing device boot. This denial of service can disrupt device availability. Furthermore, if CONFIG_LMB is disabled, exploitation may lead to memory corruption, potentially causing undefined behavior or further compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, mitigating this vulnerability may require network-level protections to block malformed TCP SYN+ACK packets targeting the bootloader. Monitor vendor communications for updates on official fixes.