Critical severityNVD Advisory· Published Sep 29, 2026· Updated Sep 29, 2026

CVE-2026-15390

Description

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets.

This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

Affected products

U Boot/U Bootllm-fuzzy

Patches

Vulnerability mechanics

References

cert.pl/en/posts/2026/09/CVE-2026-15390nvd
source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fanvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000