SB20260816372 - Out-of-bounds read in Linux kernel fpga driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-72158)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in create_feature_instance() when processing crafted DFHv1 parameter headers from a malicious FPGA device. An attacker with physical access can provide a malicious FPGA device with crafted parameter headers to cause a denial of service.

The issue occurs because the computed parameter size can exceed the feature boundary and is then used in a memcpy_fromio() operation against the ioremap'd region.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/012683accbb7d2bcf1264f2a0ecd6aa1dcea4d68
• https://git.kernel.org/stable/c/3b622aa447cf26104f96a8be39539367863bc6b6
• https://git.kernel.org/stable/c/9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a
• https://git.kernel.org/stable/c/b2f6220e929b2a43605331d0139e65dc1640c05c
• https://git.kernel.org/stable/c/f3df5386e3bb54626c117bd85e0158d45fb4aea9