CVE-2026-72158fpga: dfl: add bounds check in dfh_get_param_size()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh_get_param_size() dfh_get_param_size() can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP (End of Parameters) bit is set in the same iteration, the inflated size is returned without re-validation against max. This can cause create_feature_instance() to call memcpy_fromio() with a size exceeding the ioremap'd region when a malicious FPGA device provides crafted DFHv1 parameter headers. Add a bounds check after the size increment to ensure the accumulated size never exceeds the feature boundary.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4747ab89b4a652f835494fcf8342aaa0efb9b0fd before b2f6220e929b2a43605331d0139e65dc1640c05c; 4747ab89b4a652f835494fcf8342aaa0efb9b0fd builds before 3b622aa447cf26104f96a8be39539367863bc6b6; from 4747ab89b4a652f835494fcf8342aaa0efb9b0fd before 012683accbb7d2bcf1264f2a0ecd6aa1dcea4d68; from 4747ab89b4a652f835494fcf8342aaa0efb9b0fd before f3df5386e3bb54626c117bd85e0158d45fb4aea9; 4747ab89b4a652f835494fcf8342aaa0efb9b0fd builds before 9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a | CNA record |
References
- https://git.kernel.org/stable/c/b2f6220e929b2a43605331d0139e65dc1640c05c
- https://git.kernel.org/stable/c/3b622aa447cf26104f96a8be39539367863bc6b6
- https://git.kernel.org/stable/c/012683accbb7d2bcf1264f2a0ecd6aa1dcea4d68
- https://git.kernel.org/stable/c/f3df5386e3bb54626c117bd85e0158d45fb4aea9
- https://git.kernel.org/stable/c/9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.