TLDR Tech / InfoSec
Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot
Researchers from Binarly discovered six new vulnerabilities in the U-Boot bootloader. Two of the vulnerabilities could lead to arbitrary code execution, whereas the other four could be exploited to launch denial-of-service attacks against vulnerable devices. All six bugs (tracked as BRLY-2026-037 through BRLY-2026-042, no CVEs assigned yet) occur when U-Boot parses an untrusted FIT image before checking its signature, and most of the vulnerable code traces back to v2013.07 across 50+ stable releases, plus vendor firmware built on U-Boot. The two RCE bugs (BRLY-2026-037 and BRLY-2026-038) both stem from U-Boot trusting an unchecked null pointer and negative length returned by fdt_get_name, a libfdt lookup shared with the Linux kernel and barebox. The four crash bugs come from unchecked size/offset trust, an unvalidated null pointer from an older image format, and unbounded recursion during validation.
Read the full story