This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2025-70290 →

DEBIAN-CVE-2025-70290

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed o...

Original description

The description as published by the source.

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 u-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 u-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 u-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org