The vulnerability in U-Boot up to version 2026.04-rc3 exists in the tcp_rx_state_machine() function within net/tcp.c when CONFIG_PROT_TCP is enabled. A remote attacker can send a specially crafted TCP packet where the IP total length is smaller than the TCP data offset field indicates. For example, an IP total length of 40 bytes combined with a TCP data offset claiming 60 bytes causes tcp_parse_options() to read 40 bytes beyond the TCP segment's end. This out-of-bounds read can corrupt critical TCP connection state variables such as rmt_win_scale and rmt_timestamp, potentially disrupting TCP window calculations and connection stability. The vulnerability is classified as CWE-125 (Out-of-bounds Read). No known exploits are reported in the wild, and no patch or official fix information is currently available.

Remote attackers can cause out-of-bounds reads by sending malformed TCP packets, leading to corruption of TCP connection state variables. This may disrupt TCP window calculations and affect the stability and reliability of TCP connections handled by U-Boot with CONFIG_PROT_TCP enabled. There is no indication of privilege escalation or code execution from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling CONFIG_PROT_TCP if feasible to mitigate exposure. Monitor vendor channels for updates regarding an official fix.