USN-8884-1: security flaws in the U-Boot bootloader (Ubuntu)

Advisory USN-8884-1, dated 6 October 2026 in the Ubuntu Security feed, describes four vulnerabilities in U-Boot, a bootloader used in many embedded systems. CVE-2025-70290 and CVE-2025-70293 concern malformed metadata in ZFS filesystems and incorrect buffer size calculation in ext4 filesystems, respectively. CVE-2026-15390 affects fragmented IP traffic when IP defragmentation is enabled. CVE-2026-71971 affects IP fragments during network boot, also with defragmentation enabled. According to the text, CVE-2025-70293 affected only Ubuntu 18.04, 20.04, 22.04, 24.04 and 26.04 LTS. The possible outcomes listed are arbitrary code execution, out-of-bounds memory access and denial of service, depending on whether an attacker can exploit each flaw. To verify, consult the original advisory through the official Ubuntu Security channel, check the CVEs cited, and compare the U-Boot version in use with the fixed versions listed.