The vulnerability in U-Boot through 2026.04-rc3 is an integer underflow in the tcp_rx_state_machine() function (net/tcp.c). A network-adjacent attacker can send a malformed TCP SYN+ACK packet with a manipulated data offset field, causing the payload_len variable to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without validating the segment window, the negative payload_len is implicitly converted to a large unsigned integer and passed to memcpy() in store_block(). This results in an immediate crash of the bootloader, preventing device boot, and may enable memory corruption when CONFIG_LMB is disabled.

The vulnerability allows a network-adjacent attacker to cause a denial of service by crashing the bootloader, which prevents the device from booting. Additionally, if the CONFIG_LMB option is disabled, the flaw may lead to memory corruption, potentially causing further instability or undefined behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit network exposure of devices running affected U-Boot versions to trusted networks to reduce the risk of exploitation.