The vulnerability exists in U-Boot through version 2026.04-rc3 in the nfs_readlink_reply() function within net/nfs-common.c when CONFIG_CMD_NFS is enabled. A malicious or compromised NFS server can send two or more READLINK responses containing large relative symlink targets (~1100 bytes each) that are appended to a 2048-byte buffer without cumulative length checks. This causes a buffer overflow that corrupts adjacent BSS variables such as nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id. The corruption can lead to memory corruption and potentially allow an attacker to control the NFS client state machine. The vulnerability affects numerous Ubuntu U-Boot package versions spanning multiple Ubuntu LTS and non-LTS releases. No vendor advisory or patch information is included in the data.

Successful exploitation can cause memory corruption in the NFS client state machine by overflowing a fixed-size buffer with unchecked relative symlink targets from a malicious NFS server. This may allow an attacker to manipulate internal NFS client variables and potentially gain control over the NFS client state machine. The impact is rated high due to the potential for control over client state and memory corruption. There are no known exploits in the wild according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available information. Until a patch is available, avoid enabling CONFIG_CMD_NFS or connecting to untrusted NFS servers to reduce exposure to this vulnerability.