Ubuntu alert USN-8056-1 (u-boot)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8056-1] U-Boot vulnerabilities
Date:
             
 
Mon, 23 Feb 2026 14:56:11 +0000
Message-ID:
             
 
<E1vuXM3-0005VO-LI@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8056-1
February 23, 2026

u-boot vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in U-Boot.

Software Description:
- u-boot: A boot loader for embedded systems

Details:

Simon Diepold discovered that U-Boot incorrectly handled certain DHCP
responses. An attacker on the local network could possibly use this issue
to obtain sensitive memory contents. (CVE-2024-42040)

It was discovered that U-Boot incorrectly handled symlink size calculations
in squashfs file systems. An attacker could use this issue with a specially
crafted squashfs file system to cause U-Boot to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2024-57254)

It was discovered that U-Boot incorrectly handled inode size calculations
in squashfs file systems. An attacker could use this issue with a specially
crafted squashfs file system to cause U-Boot to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2024-57255)

It was discovered that U-Boot incorrectly handled inode size calculations
in EXT4 file systems. An attacker could use this issue with a specially
crafted EXT4 file system to cause U-Boot to crash, resulting in a denial of
service, or execute arbitrary code. (CVE-2024-57256)

It was discovered that U-Boot incorrectly handled deep symlink nesting in
squashfs file systems. An attacker could possibly use this issue with a
specially crafted squashfs file system to cause U-Boot to crash, resulting
in a denial of service. (CVE-2024-57257)

It was discovered that U-Boot incorrectly handled memory allocation in
squashfs file systems. An attacker could use this issue with a specially
crafted squashfs file system to cause U-Boot to crash, resulting in a denial
of service, or execute arbitrary code. (CVE-2024-57258)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  u-boot-amlogic                  2025.10-0ubuntu0.24.04.2
  u-boot-asahi                    2025.10-0ubuntu0.24.04.2
  u-boot-exynos                   2025.10-0ubuntu0.24.04.2
  u-boot-imx                      2025.10-0ubuntu0.24.04.2
  u-boot-microchip                2025.10-0ubuntu0.24.04.2
  u-boot-mvebu                    2025.10-0ubuntu0.24.04.2
  u-boot-omap                     2025.10-0ubuntu0.24.04.2
  u-boot-qcom                     2025.10-0ubuntu0.24.04.2
  u-boot-qemu                     2025.10-0ubuntu0.24.04.2
  u-boot-rockchip                 2025.10-0ubuntu0.24.04.2
  u-boot-rpi                      2025.10-0ubuntu0.24.04.2
  u-boot-sifive                   2025.10-0ubuntu0.24.04.2
  u-boot-sitara-binaries          2025.10-0ubuntu0.24.04.2
  u-boot-starfive                 2025.10-0ubuntu0.24.04.2
  u-boot-stm32                    2025.10-0ubuntu0.24.04.2
  u-boot-sunxi                    2025.10-0ubuntu0.24.04.2
  u-boot-tegra                    2025.10-0ubuntu0.24.04.2
  u-boot-tools                    2025.10-0ubuntu0.24.04.2

Ubuntu 22.04 LTS
  u-boot                          2022.01+dfsg-2ubuntu2.7
  u-boot-amlogic                  2022.01+dfsg-2ubuntu2.7
  u-boot-exynos                   2022.01+dfsg-2ubuntu2.7
  u-boot-imx                      2022.01+dfsg-2ubuntu2.7
  u-boot-microchip                2022.01+dfsg-2ubuntu2.7
  u-boot-mvebu                    2022.01+dfsg-2ubuntu2.7
  u-boot-omap                     2022.01+dfsg-2ubuntu2.7
  u-boot-qcom                     2022.01+dfsg-2ubuntu2.7
  u-boot-qemu                     2022.01+dfsg-2ubuntu2.7
  u-boot-rockchip                 2022.01+dfsg-2ubuntu2.7
  u-boot-rpi                      2022.01+dfsg-2ubuntu2.7
  u-boot-sifive                   2022.01+dfsg-2ubuntu2.7
  u-boot-sunxi                    2022.01+dfsg-2ubuntu2.7
  u-boot-tegra                    2022.01+dfsg-2ubuntu2.7
  u-boot-tools                    2022.01+dfsg-2ubuntu2.7

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8056-1
  CVE-2024-57254, CVE-2024-57255, CVE-2024-57256, CVE-2024-57257,
  CVE-2024-57258, CVE-2024-57259

Package Information:
  https://launchpad.net/ubuntu/+source/u-boot/2025.10-0ubun...
  https://launchpad.net/ubuntu/+source/u-boot/2022.01+dfsg-...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmmcagIACgkQcpJm3tlz
hgFhSRAAlG2s9jOCWpytWm1Qa3tQqJrvnlKvUz5ERQje6C6lkBPNbDQ4IL/AtaZE
rs1napf1Hlowzt20UgpG2c9vzd0F6Shz2Yip/iPy/rXR6zAqfO75R4ns828gJyEJ
HJwg9peKO+lnqYWTrN0V3Pi/MsDc4DZtN8pmYs3uJo47Njw3XyjQ+49/kYD/4qbL
uzOsRFPjXCG5IA/et1nKrB01LRdtqwXUxMDWD+FvpuvdrOvwdN4BlJnG9lx+LvN6
naFPQ9elVq7TqNVyLHl/cjNOMmTDWWm9ZFXM74Y6V1d5vCXmJsrosl5buiJvwDDd
59rLIWUI9o27/zH59mBlWXDnWeySi5XGLyLwCyH6ZOg82ilarVFdPBs+gbx8UzHU
DS9kdc6oFPrEUHryMXfvUwCX0hvJUHsW8GgiO0wa014pgJyjX9k5Rc3sCmtwBIR5
yaJgbMXjlhFgMS6AbVovi6yLcdNolN/F0MTga3Ul95DT2HvARdhvAq8a8219A3RO
wPvi8ZKsY+KmwAgAusNfDLlbJkH70MVVWFE6zaXRARlo9wliRYkKNSwepHBa7Vw9
DiYbxypES9T7dDllXKXoBV2Cz36UvNIYdbFYM2NxTI/DDS+lMMgmmEntMvE2ZPx+
q1V7j/PM6wCTSTHS4jCFtAatgOcMxCLMrop+YD4GAoLRZX2knyw=
=oZ37
-----END PGP SIGNATURE-----