U-Boot Use-After-Free in lwIP wget Implementation

U-Boot versions prior to 2026.10-rc5 contain a critical use-after-free vulnerability located within the httpc_recv_cb() function of the lwIP (lightweight IP) wget implementation. This flaw manifests when an HTTP data storage operation fails during the download process. In this failure state, the callback incorrectly frees the connection's Protocol Control Block (PCB) but proceeds to return an ERR_BUF status instead of the required ERR_ABRT. This discrepancy allows the TCP input path to subsequently reference the previously freed memory space, resulting in memory corruption and a hard crash of the bootloader. Because this occurs during the boot process, successful exploitation results in an immediate denial-of-service condition for the affected device.

Impact

The vulnerability poses a significant risk to embedded systems utilizing U-Boot for network-based boot processes. If successfully triggered, the vulnerability results in a system-wide denial-of-service, as the device becomes unable to complete the boot sequence. This is particularly relevant for hardware platforms configured to perform automated firmware updates or netboot operations via the U-Boot lwIP stack.

Recommendation

• Upgrade U-Boot to version 2026.10-rc5 or later to receive the patch for CVE-2026-74222.
• Audit network-accessible boot configurations on embedded devices to restrict access to trusted internal management subnets.
• If immediate patching is not possible, disable the network-based boot features or the wget functionality in the U-Boot environment until the firmware can be updated.