CVE-2026-15390

— UNSCORED

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

Weaknesses

CWE-459, CWE-787

All references

https://cert.pl/en/posts/2026/09/CVE-2026-15390
https://source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fa

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-10027
HIGHCVE-2026-100504PoC
CRITICALCVE-2026-100740
HIGHCVE-2026-100888
MEDIUMCVE-2026-101100PoC
MEDIUMCVE-2026-101202
MEDIUMCVE-2026-101203
HIGHCVE-2026-102004

Related by shared AI tags and CWE weakness class. Browse the full archive.