Hi,

The following vulnerabilities were published for u-boot.

CVE-2025-70290[0]:
| An issue was discovered in Denx U-Boot before 2026.04. An integer
| overflow vulnerability in the ZFS filesystem support can be
| triggered by malformed on-disk metadata. The issue may result in
| incorrect memory allocation followed by out-of-bounds memory access,
| potentially leading to a crash or arbitrary code execution during
| the boot process.


CVE-2025-70291[1], CVE-2025-70292[2], and

CVE-2025-70293[3]:
| An issue was discovered in Denx U-Boot before 2026.04. An integer
| overflow vulnerability exists in function ext4fs_get_bgdtable, the
| size calculation can lead to under allocation and this
| underallocated buffer will be used in memcpy() which could lead to
| arbitrary code execution, a denial of service, or other unspecified
| impacts.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-70290
https://www.cve.org/CVERecord?id=CVE-2025-70290
[1] https://security-tracker.debian.org/tracker/CVE-2025-70291
https://www.cve.org/CVERecord?id=CVE-2025-70291
[2] https://security-tracker.debian.org/tracker/CVE-2025-70292
https://www.cve.org/CVERecord?id=CVE-2025-70292
[3] https://security-tracker.debian.org/tracker/CVE-2025-70293
https://www.cve.org/CVERecord?id=CVE-2025-70293

Regards,
Salvatore