U-Boot versions through 2026.04-rc3 contain an integer underflow vulnerability in the tcp_rx_state_machine() function. A network-adjacent attacker can send a malformed TCP SYN+ACK packet with a manipulated data offset field, causing the payload length to become negative. This negative value is converted to a large unsigned integer and passed to memcpy(), resulting in an immediate crash of the bootloader that prevents device boot. If CONFIG_LMB is disabled, this may also lead to memory corruption.