This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2025-70290 →
UBUNTU-CVE-2025-70290
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed o...
Original description
The description as published by the source.
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:16.04:LTS
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.01+dfsg1-2ubuntu5+esm1"}]}]
Ubuntu:Pro:18.04:LTS
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.10+dfsg-1ubuntu0~18.04.3+esm1"}]}]
Ubuntu:Pro:20.04:LTS
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01+dfsg-3ubuntu0~20.04.6+esm1"}]}]
Ubuntu:22.04:LTS
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01+dfsg-2ubuntu2.8"}]}]
Ubuntu:22.04:LTS
u-boot-nezha
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu0.24.04.3"}]}]
Ubuntu:24.04:LTS
u-boot-nezha
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu5"}]}]
Ubuntu:26.04:LTS
u-boot
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu2.1"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org