UbuntuUpdates.org

Package "u-boot"

Name: u-boot

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • A boot loader for qemu
  • companion tools for Das U-Boot bootloader
Latest version: 2025.10-0ubuntu2.1
Release: resolute (26.04)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "u-boot" in Resolute

Repository Area Version
base main 2025.10-0ubuntu2
security main 2025.10-0ubuntu2.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2025.10-0ubuntu2.1 2026-10-07 15:39:07 UTC

u-boot (2025.10-0ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Integer overflow in ZFS filesystem metadata parsing
    - debian/patches/CVE-2025-70290.patch: Prevent integer overflow in
      zfs_nvlist_lookup in fs/zfs/zfs.c.
    - CVE-2025-70290
  * SECURITY UPDATE: Integer overflow in ext4 block group descriptor sizing
    - debian/patches/CVE-2025-70293.patch: Prevent integer overflow in
      ext4fs_get_bgdtable in fs/ext4/ext4_write.c.
    - CVE-2025-70293
  * SECURITY UPDATE: Stale IP defragmentation state after datagram reassembly
    - debian/patches/CVE-2026-15390_1.patch: Clear IP defragmentation state
      after returning a complete packet in net/net.c.
    - debian/patches/CVE-2026-15390_2.patch: Add IP defragmentation
      duplicate-fragment regression test in test/dm/Makefile,
      test/dm/net_defrag.c.
    - CVE-2026-15390
  * SECURITY UPDATE: Out-of-bounds write in IP fragment reassembly
    - debian/patches/CVE-2026-71971_1.patch: Fix out-of-bounds write in IP
      fragment reassembly in net/net.c.
    - debian/patches/CVE-2026-71971_2.patch: Add regression test for IP
      reassembly overflow in test/dm/net_defrag.c.
    - CVE-2026-71971

 -- Shafayat Hossain Majumder Thu, 01 Oct 2026 16:02:51 -0400
CVE-2025-70290 An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed
CVE-2025-70293 An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation
CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fra
CVE-2026-71971 U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c


About   -   Send Feedback to @ubuntu_updates