OCTOBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-71971

HIGH · CVSS 8.2 EPSS 0.38% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-29 · Last synced 2026-10-08

CyberRota Analysis

AI-Generated

U-Boot versions prior to 2026.10-rc3 with CONFIG_IP_DEFRAG enabled are vulnerable to an out-of-bounds write in the __net_defragment() function, allowing remote attackers to exploit crafted IP fragments. This vulnerability can lead to memory corruption and crash the bootloader, potentially disrupting system availability. Organizations using affected U-Boot versions in their networked devices should prioritize patching to mitigate the risk of remote exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-71971
Severity
HIGH
CVSS
8.2
EPSS
0.38%

Original NVD Description

U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.