Out-of-bounds read in Linux kernel - CVE-2026-72158
Published: August 16, 2026
Vulnerability identifier: #VU143436
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72158
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in create_feature_instance() when processing crafted DFHv1 parameter headers from a malicious FPGA device. An attacker with physical access can provide a malicious FPGA device with crafted parameter headers to cause a denial of service.
The issue occurs because the computed parameter size can exceed the feature boundary and is then used in a memcpy_fromio() operation against the ioremap'd region.
Affected software
Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
How to mitigate CVE-2026-72158
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
External References
- https://git.kernel.org/stable/c/012683accbb7d2bcf1264f2a0ecd6aa1dcea4d68
- https://git.kernel.org/stable/c/3b622aa447cf26104f96a8be39539367863bc6b6
- https://git.kernel.org/stable/c/9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a
- https://git.kernel.org/stable/c/b2f6220e929b2a43605331d0139e65dc1640c05c
- https://git.kernel.org/stable/c/f3df5386e3bb54626c117bd85e0158d45fb4aea9