The vulnerability in U-Boot up to version 2026.04-rc3 exists in the nfs_readlink_reply() function within net/nfs-common.c, triggered when CONFIG_CMD_NFS is enabled. A malicious NFS server can exploit this buffer overflow by sending two or more READLINK responses with relative symlink targets of about 1100 bytes each. These targets are appended without cumulative length checks, overflowing the 2048-byte nfs_path_buff buffer. This overflow corrupts adjacent BSS variables such as nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, which may allow an attacker to manipulate the NFS client state machine and cause memory corruption.

Successful exploitation can lead to memory corruption of critical NFS client variables, potentially allowing an attacker to control the NFS client state machine. This could disrupt normal NFS operations or enable further attacks on the client system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling CONFIG_CMD_NFS if feasible to mitigate exposure. Monitor vendor communications for updates on fixes.