new file mode 100644
@@ -0,0 +1,53 @@
+From d6694018eaddefac6aae974f9cec72fd6e58f1bc Mon Sep 17 00:00:00 2001
+From: Sebastian Josue Alba Vives <sebasjosue84@gmail.com>
+Date: Thu, 9 Apr 2026 10:44:40 -0600
+Subject: [PATCH] net: nfs: fix buffer overflow in nfs_readlink_reply()
+
+nfs_readlink_reply() validates rlen only against the incoming packet
+length (inherited from CVE-2019-14195), but not against the destination
+buffer nfs_path_buff[2048]. A malicious NFS server can send a valid
+READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff),
+overflowing the BSS buffer into adjacent memory.
+
+The recent fix in fd6e3d34097f addressed the same overflow class in
+net/lwip/nfs.c but left the legacy path in net/nfs-common.c unpatched.
+
+Add bounds checks before both memcpy calls in nfs_readlink_reply():
+- relative path branch: reject if pathlen + rlen >=
+ sizeof(nfs_path_buff)
+- absolute path branch: reject if rlen >= sizeof(nfs_path_buff)
+
+Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195")
+
+CVE: CVE-2026-29009
+
+Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
+Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ net/nfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/nfs.c b/net/nfs.c
+index 537d4c62..9b628ecf 100644
+--- a/net/nfs.c
++++ b/net/nfs.c
+@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len)
+
+ strcat(nfs_path, "/");
+ pathlen = strlen(nfs_path);
++ if (pathlen + rlen >= sizeof(nfs_path_buff))
++ return -NFS_RPC_DROP;
+ memcpy(nfs_path + pathlen,
+ (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ rlen);
+ nfs_path[pathlen + rlen] = 0;
+ } else {
++ if (rlen >= sizeof(nfs_path_buff))
++ return -NFS_RPC_DROP;
+ memcpy(nfs_path,
+ (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]),
+ rlen);
@@ -3,7 +3,9 @@ require u-boot.inc
DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
-SRC_URI += "file://CVE-2026-46728.patch"
+SRC_URI += "file://CVE-2026-46728.patch \
+ file://CVE-2026-29009.patch \
+"
CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
Backport commit[1] which fixes this vulnerability as mentioned NVD report in [2]. [1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc [2] https://nvd.nist.gov/vuln/detail/cve-2026-29009 Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com> --- .../u-boot/files/CVE-2026-29009.patch | 53 +++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 +- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch