Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.
FEDORA-2026-313e66c007 (bcm283x-firmware-20260907-1.b76effd.fc45 and uboot-tools-2026.10-0.4.rc4.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-313e66c007
As Fedora uses the LWIP stack I don't believe we're vulnerable
FEDORA-2026-313e66c007 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-313e66c007` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-313e66c007 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-313e66c007 (bcm283x-firmware-20260907-1.b76effd.fc45 and uboot-tools-2026.10-0.4.rc4.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.