CVE-2026-72156fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5f8d4a9008307e0bf210906948953386935d361c before e45ec24d8e986d79a8e07f49a816c414ad283622; 5f8d4a9008307e0bf210906948953386935d361c builds before 0d3766fecd9b2db39a18b48021c15c522997ec25; from 5f8d4a9008307e0bf210906948953386935d361c before a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf; from 5f8d4a9008307e0bf210906948953386935d361c before c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f; 5f8d4a9008307e0bf210906948953386935d361c builds before 3da8eaf5469eda2353b72038d644fabddb848ce1; from 5f8d4a9008307e0bf210906948953386935d361c before 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 | CNA record |
References
- https://git.kernel.org/stable/c/e45ec24d8e986d79a8e07f49a816c414ad283622
- https://git.kernel.org/stable/c/0d3766fecd9b2db39a18b48021c15c522997ec25
- https://git.kernel.org/stable/c/a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf
- https://git.kernel.org/stable/c/c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f
- https://git.kernel.org/stable/c/3da8eaf5469eda2353b72038d644fabddb848ce1
- https://git.kernel.org/stable/c/43a1974da6bc7ce8f4d1dc1d03d56997428c29c3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.