[OE-core][wrynose][PATCH] u-boot: fix CVE-2026-29009

[OE-core][wrynose][PATCH] u-boot: fix CVE-2026-29009

[Roopa Kalmath]

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in
nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled,
allowing a malicious or compromised NFS server to overflow the 2048-byte
nfs_path_buff buffer by returning multiple relative symlink targets that
are appended without cumulative length validation. Attackers can send
two or more READLINK responses containing relative symlink targets of
approximately 1100 bytes each to corrupt adjacent BSS variables
including nfs_server_ip, nfs_server_mount_port, nfs_server_port,
nfs_our_port, nfs_state, and rpc_id, potentially achieving memory
corruption and control over the NFS client state machine.

Reference:
[https://www.cve.org/CVERecord?id=CVE-2026-29009]

Backport the patch to fix CVE-2026-29009:
[https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]

Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
 .../u-boot/files/CVE-2026-29009.patch         | 34 +++++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 ++-
 2 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch

diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
new file mode 100644
index 0000000000..1e04562ede
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
@@ -0,0 +1,34 @@
+From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
+From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+Date: Fri, 9 Oct 2026 08:38:23 +0000
+Subject: [PATCH] u-boot:Fix CVE-2026-29009
+
+CVE: CVE-2026-29009
+
+Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
+
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ net/nfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/nfs.c b/net/nfs.c
+index 537d4c62..9b628ecf 100644
+--- a/net/nfs.c
++++ b/net/nfs.c
+@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len)
+ 
+ 		strcat(nfs_path, "/");
+ 		pathlen = strlen(nfs_path);
++		if (pathlen + rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path + pathlen,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
+ 		nfs_path[pathlen + rlen] = 0;
+ 	} else {
++		if (rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
index 9610d9e8fe..8dd15cf9cd 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
@@ -3,7 +3,9 @@ require u-boot.inc
 
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
 
-SRC_URI += "file://CVE-2026-46728.patch"
+SRC_URI += "file://CVE-2026-46728.patch \
+            file://CVE-2026-29009.patch \
+"
 
 CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
 
-- 
2.49.1

Re: [OE-core][wrynose][PATCH] u-boot: fix CVE-2026-29009

[Yoann Congal]

Hello,

I have a few format issues with your patch but the gist of it looks good
to me.

On Fri Oct 9, 2026 at 2:02 PM CEST, Roopa via lists.openembedded.org Kalmath wrote:
> U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in
> nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled,
> allowing a malicious or compromised NFS server to overflow the 2048-byte
> nfs_path_buff buffer by returning multiple relative symlink targets that
> are appended without cumulative length validation. Attackers can send
> two or more READLINK responses containing relative symlink targets of
> approximately 1100 bytes each to corrupt adjacent BSS variables
> including nfs_server_ip, nfs_server_mount_port, nfs_server_port,
> nfs_our_port, nfs_state, and rpc_id, potentially achieving memory
> corruption and control over the NFS client state machine.

All this paragraph is the CVE description which is not what reader of
these commit messages look for. We want to know what you did to fix the
CVE and why. In this case a simple
"Backport fix referenced by NVD: https://nvd.nist.gov/vuln/detail/cve-2026-29009"
is enough.

Look at https://git.openembedded.org/openembedded-core/log/?h=wrynose&qt=grep&q=CVE
to get an idea of what a commit message usually look like.

> Reference:
> [https://www.cve.org/CVERecord?id=CVE-2026-29009]
>
> Backport the patch to fix CVE-2026-29009:
> [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
>
> Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> ---
>  .../u-boot/files/CVE-2026-29009.patch         | 34 +++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 ++-
>  2 files changed, 37 insertions(+), 1 deletion(-)
>  create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
>
> diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> new file mode 100644
> index 0000000000..1e04562ede
> --- /dev/null
> +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> @@ -0,0 +1,34 @@
> +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
> +From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> +Date: Fri, 9 Oct 2026 08:38:23 +0000
> +Subject: [PATCH] u-boot:Fix CVE-2026-29009
> +
> +CVE: CVE-2026-29009
> +
> +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
> +
> +Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>

While backporting this patch you complely erased the existing commit
message and authorship information. Please keep those, they help
checking that we are indeed fixing the vulnerability, not introducing
regressions, ...

Can you send a v2 with the above fixed?

Thanks!
-- 
Yoann Congal
Smile ECS

[OE-core][wrynose][PATCH v2] u-boot: fix CVE-2026-29009

[Roopa Kalmath]

nfs_readlink_reply() validates rlen only against the incoming packet
length (inherited from CVE-2019-14195), but not against the destination
buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
overflowing the BSS buffer into adjacent memory.

Reference:
[https://nvd.nist.gov/vuln/detail/cve-2026-29009]
[https://www.cve.org/CVERecord?id=CVE-2026-29009]

Backport the patch to fix CVE-2026-29009:
[https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]

Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
 .../u-boot/files/CVE-2026-29009.patch         | 38 +++++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 +-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch

diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
new file mode 100644
index 0000000000..860e504414
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
@@ -0,0 +1,38 @@
+From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
+From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+Date: Fri, 9 Oct 2026 08:38:23 +0000
+Subject: [PATCH] u-boot:Fix CVE-2026-29009
+
+CVE: CVE-2026-29009
+
+Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
+
+Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ net/nfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/nfs.c b/net/nfs.c
+index 537d4c62..9b628ecf 100644
+--- a/net/nfs.c
++++ b/net/nfs.c
+@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len)
+ 
+ 		strcat(nfs_path, "/");
+ 		pathlen = strlen(nfs_path);
++		if (pathlen + rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path + pathlen,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
+ 		nfs_path[pathlen + rlen] = 0;
+ 	} else {
++		if (rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
index 9610d9e8fe..8dd15cf9cd 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
@@ -3,7 +3,9 @@ require u-boot.inc
 
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
 
-SRC_URI += "file://CVE-2026-46728.patch"
+SRC_URI += "file://CVE-2026-46728.patch \
+            file://CVE-2026-29009.patch \
+"
 
 CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
 
-- 
2.49.1

Re: [OE-core][wrynose][PATCH v2] u-boot: fix CVE-2026-29009

[Yoann Congal]

Hello,

This second version still has issues and those are similar to v1.

On Mon Oct 12, 2026 at 1:14 PM CEST, Roopa via lists.openembedded.org Kalmath wrote:
> nfs_readlink_reply() validates rlen only against the incoming packet
> length (inherited from CVE-2019-14195), but not against the destination
> buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
> READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
> overflowing the BSS buffer into adjacent memory.

This paragraph above is referencing upstream code. This is not what need
explaining here.

>
> Reference:
> [https://nvd.nist.gov/vuln/detail/cve-2026-29009]
> [https://www.cve.org/CVERecord?id=CVE-2026-29009]
>
> Backport the patch to fix CVE-2026-29009:
> [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]

... instead, please explain why you think the above commit is the right
one to fix this CVE? (e.g. it is referenced from a trusted source: NVD,
Debian, ...)

>
> Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> ---
>  .../u-boot/files/CVE-2026-29009.patch         | 38 +++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 +-
>  2 files changed, 41 insertions(+), 1 deletion(-)
>  create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
>
> diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> new file mode 100644
> index 0000000000..860e504414
> --- /dev/null
> +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> @@ -0,0 +1,38 @@
> +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
> +From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> +Date: Fri, 9 Oct 2026 08:38:23 +0000
> +Subject: [PATCH] u-boot:Fix CVE-2026-29009

Please keep the original:
* Subject: " net: nfs: fix buffer overflow in nfs_readlink_reply() "
* Author: "Sebastian Alba Vives"
* Commit message "nfs_readlink_reply() validates rlen only against the incoming [...]"


> +
> +CVE: CVE-2026-29009
> +
> +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
> +
> +Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
> +Cc: stable@vger.kernel.org
> +Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
> +Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
> +Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> +---
> + net/nfs.c | 4 ++++
> + 1 file changed, 4 insertions(+)

Regards,
-- 
Yoann Congal
Smile ECS

[OE-core][wrynose][PATCH v3] u-boot: fix CVE-2026-29009

[Roopa Kalmath]

Backport commit[1] which fixes this vulnerability as mentioned NVD
report in [2].

[1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc
[2] https://nvd.nist.gov/vuln/detail/cve-2026-29009

Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
 .../u-boot/files/CVE-2026-29009.patch         | 38 +++++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 +-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch

diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
new file mode 100644
index 0000000000..afdbc80519
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
@@ -0,0 +1,38 @@
+From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
+From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+Date: Fri, 9 Oct 2026 08:38:23 +0000
+Subject: net: nfs: fix buffer overflow in nfs_readlink_reply()
+
+CVE: CVE-2026-29009
+
+Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
+
+Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ net/nfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/nfs.c b/net/nfs.c
+index 537d4c62..9b628ecf 100644
+--- a/net/nfs.c
++++ b/net/nfs.c
+@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len)
+ 
+ 		strcat(nfs_path, "/");
+ 		pathlen = strlen(nfs_path);
++		if (pathlen + rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path + pathlen,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
+ 		nfs_path[pathlen + rlen] = 0;
+ 	} else {
++		if (rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
index 9610d9e8fe..8dd15cf9cd 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
@@ -3,7 +3,9 @@ require u-boot.inc
 
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
 
-SRC_URI += "file://CVE-2026-46728.patch"
+SRC_URI += "file://CVE-2026-46728.patch \
+            file://CVE-2026-29009.patch \
+"
 
 CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
 
-- 
2.49.1

Re: [OE-core][wrynose][PATCH v3] u-boot: fix CVE-2026-29009

[Yoann Congal]

On Tue Oct 13, 2026 at 11:58 AM CEST, Roopa via lists.openembedded.org Kalmath wrote:
> Backport commit[1] which fixes this vulnerability as mentioned NVD
> report in [2].
>
> [1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc
> [2] https://nvd.nist.gov/vuln/detail/cve-2026-29009
>
> Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> ---
>  .../u-boot/files/CVE-2026-29009.patch         | 38 +++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 +-
>  2 files changed, 41 insertions(+), 1 deletion(-)
>  create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
>
> diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> new file mode 100644
> index 0000000000..afdbc80519
> --- /dev/null
> +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> @@ -0,0 +1,38 @@
> +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
> +From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
         ^ (again) please keep the original author

> +Date: Fri, 9 Oct 2026 08:38:23 +0000
> +Subject: net: nfs: fix buffer overflow in nfs_readlink_reply()
> +

(again) please keep the original commit message

> +CVE: CVE-2026-29009
> +
> +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
> +
> +Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
> +Cc: stable@vger.kernel.org
> +Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
> +Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
> +Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
-- 
Yoann Congal
Smile ECS

[OE-core][wrynose][PATCH v4] u-boot: fix CVE-2026-29009

[Roopa Kalmath]

Backport commit[1] which fixes this vulnerability as mentioned NVD
report in [2].

[1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc
[2] https://nvd.nist.gov/vuln/detail/cve-2026-29009

Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
 .../u-boot/files/CVE-2026-29009.patch         | 53 +++++++++++++++++++
 meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 +-
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch

diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
new file mode 100644
index 0000000000..35f168005e
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
@@ -0,0 +1,53 @@
+From d6694018eaddefac6aae974f9cec72fd6e58f1bc Mon Sep 17 00:00:00 2001
+From: Sebastian Josue Alba Vives <sebasjosue84@gmail.com>
+Date: Thu, 9 Apr 2026 10:44:40 -0600
+Subject: [PATCH] net: nfs: fix buffer overflow in nfs_readlink_reply()
+
+nfs_readlink_reply() validates rlen only against the incoming packet
+length (inherited from CVE-2019-14195), but not against the destination
+buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
+READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
+overflowing the BSS buffer into adjacent memory.
+
+The recent fix in fd6e3d34097f addressed the same overflow class in
+net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched.
+
+Add bounds checks before both memcpy calls in nfs_readlink_reply():
+- relative path branch: reject if pathlen + rlen >=
+  sizeof(nfs_path_buff)
+- absolute path branch: reject if rlen >= sizeof(nfs_path_buff)
+
+Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
+
+CVE: CVE-2026-29009
+
+Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ net/nfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/nfs.c b/net/nfs.c
+index 537d4c62..9b628ecf 100644
+--- a/net/nfs.c
++++ b/net/nfs.c
+@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len)
+ 
+ 		strcat(nfs_path, "/");
+ 		pathlen = strlen(nfs_path);
++		if (pathlen + rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path + pathlen,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
+ 		nfs_path[pathlen + rlen] = 0;
+ 	} else {
++		if (rlen >= sizeof(nfs_path_buff))
++			return -NFS_RPC_DROP;
+ 		memcpy(nfs_path,
+ 		       (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ 		       rlen);
diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
index 9610d9e8fe..8dd15cf9cd 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
@@ -3,7 +3,9 @@ require u-boot.inc
 
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
 
-SRC_URI += "file://CVE-2026-46728.patch"
+SRC_URI += "file://CVE-2026-46728.patch \
+            file://CVE-2026-29009.patch \
+"
 
 CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
 
-- 
2.39.4