{"id":"AZL-105702","summary":"CVE-2026-74221 affecting package qemu 10.1.0-1","details":"U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.","modified":"2026-10-04T05:34:07Z","published":"2026-09-29T22:18:33Z","upstream":["CVE-2026-74221"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74221"}],"affected":[{"package":{"name":"qemu","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/qemu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.1.0-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105702.json"}}],"schema_version":"1.9.0"}