Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 3h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 6h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 6h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 6h Vulnerability in Sparx Systems Enterprise Architect software · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilities in Slican telephone exchanges · 8h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 11h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 11h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 11h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 3h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 6h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 6h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 6h Vulnerability in Sparx Systems Enterprise Architect software · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilities in Slican telephone exchanges · 8h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 11h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 11h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 11h
🛡️
ACyber Sentinel Security Assessment Team
← Back to feed
🇬🇧 English 🇮🇷 فارسی 🇸🇦 العربية 🇷🇺 Русский 🇨🇳 中文 🏛️ Latina
⚡ Intelligence Report

Vulnerability in Das U-Boot software

📰 cert.pl 🕐 ⏱ 1 min read ⚠️ 1 CVEs

Vulnerability in Das U-Boot software

Vulnerability in Das U-Boot software

CVE ID CVE-2026-15390
Publication date 29 September 2026
Vendor DENX Software Engineering
Product Das U-Boot
Vulnerable versions From 2009.08 through 2026.07
Vulnerability type (CWE) Out-of-bounds write (CWE-787)
Report source Report to CERT Polska

Description

CERT Polska has received a report about vulnerability in DENX Software Engineering Das U-Boot software and participated in coordination of its disclosure.

The vulnerability CVE-2026-15390: Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.

This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa included in release version 2026.07.

Credits

We thank Mateusz Furdyna from Nokia for the responsible vulnerability report.

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.

Referenced Vulnerabilities

CVE-2026-15390 CVSS 9 CRITICAL Awaiting Analysis
CVE-2026-15390 - Out-of-bounds write in Das U-Boot
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

More from cert.pl

Vulnerability in Sparx Systems Enterprise Architect software
7h
Vulnerabilities in Slican telephone exchanges
8h
Vulnerability in Payload CMS software
2d
Vulnerability in Ollama software
Oct 08