Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

Summary: Binarly researchers found six flaws in U-Boot, the bootloader used in routers, cameras, and data-center management chips, four of which can crash a device and two of which can run attacker code before the boot image's signature is checked. The vulnerable code has been in U-Boot since v2013.07 across more than 50 stable releases and in vendor firmwares built on it, tracked as advisories BRLY-2026-037 through BRLY-2026-042 with no CVE identifiers assigned.
Bottom line: U-Boot merged the six patches in June, but the July release had already frozen in April and the next release, v2026.10, is not due until October - so for everyone running a device someone else built on U-Boot, the fix only arrives as a firmware update from the product vendor.

Read the original at The Hacker News ↗