CRITICAL 9.0 NVD

CVE-2026-15390

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

References

Published: 2026-09-29 · Source: NVD · Feed updated: 2026-09-30

This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-09-29 via NVD.

Risk Timeline

CVE Disclosed2026-09-29 · 0 days ago

Remediation Resources

Official Advisory

cert.pl/en/posts/2026/09/CVE-2026-15390

Analysis & PoC

source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287

vulnfeed aggregates 10239 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.