# CVE-2026-15390

U-Boot IP defragmentation flaw permits remote RCE via crafted fragmented IP packets.

- Page: https://www.vulneraibility.com/cve/CVE-2026-15390
- CVSS: 9.0
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.19% (percentile 9.3)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-29)
- Weakness: CWE-787, CWE-459
- Published: 2026-09-29

## Affected versions

- DENX Software Engineering Das U-Boot: affected >= 2009.08 and <= 2026.07

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote arbitrary code execution by sending duplicated last-fragment IP packets during IP reassembly, enabling persistent device compromise.

## Action

Immediate action required

## Recommendation

Upgrade U-Boot to 2026.07 or apply vendor patch; block/inspect fragmented IP traffic.

## References

- [advisory] https://cert.pl/en/posts/2026/09/CVE-2026-15390
- [patch] https://source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fa

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.