Das U-Boot versions prior to 2026.04 contain a vulnerability where the FIT signature verification process can be bypassed because the hashed-nodes component is omitted from the hash calculation. This omission undermines the integrity check of the signed image, allowing an attacker with local high privileges to bypass signature verification. The vulnerability affects numerous Ubuntu-specific u-boot package versions across multiple LTS and interim releases. No known exploits in the wild have been reported. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

An attacker with high privileges on the local system can bypass the signature verification of FIT images in U-Boot, potentially allowing unauthorized code execution during the boot process. This compromises the integrity and trustworthiness of the bootloader, which can lead to full system compromise. The vulnerability affects confidentiality, integrity, and availability at a high level.

The vulnerability is fixed in Das U-Boot version 2026.04. Users should upgrade to version 2026.04 or later to remediate this issue. Since this is a local privilege and bootloader integrity issue, applying the official update is the recommended mitigation. Patch status is confirmed by the versioning information indicating the fix is in 2026.04. No vendor advisory content was provided to contradict this.