I've been reading about the six critical U-Boot vulnerabilities recently discovered by Binarly (related to FIT signature verification flaws, including CVE-2026-46728). These flaws break Secure Boot and allow for arbitrary code execution during the boot phase via unvalidated firmware images.
Given that the GL-MT6000 (Flint 2) is a flagship MediaTek device, I wanted to ask the GL.iNet team and the community:
Are there official plans to roll out an updated U-Boot binary that includes the upstream patches?
If an update is planned, will it be bundled within a standard firmware upgrade, or will we need to flash it manually via the U-Boot web UI?
Since upstream fixes have already been merged into U-Boot's master branch, it would be great to know if this is on the official roadmap for the MT6000.
I don't think GL-iNet uses signed firmware with secureboot, that would prevent replacing the bootloader which is still possible with OpenWrt factory image (I won't recommend this), because then U-boot is replaced by OpenWrts version which is a tftp server and not a web ui.
Maybe only on the chinese versions signed firmware is used, which is alot more common on chinese routers anyway.
Based on our current review, the standard GL-MT6000 boot configuration does not enable U-Boot FIT signature verification or MediaTek Secure Boot.
Therefore, CVE-2026-46728 and the vulnerabilities that specifically require the U-Boot FIT signature-verification path are not applicable to the standard GL-MT6000 configuration.
Regarding why we do not enable U-Boot FIT signing, this is an intentional design choice. The GL-MT6000 is designed to allow users to install compatible OpenWrt or other custom firmware. Enforcing MediaTek Secure Boot and U-Boot FIT signature verification would restrict the bootloader to images signed with an approved key, preventing users from freely installing compatible third-party firmware.