CVE-2026-72156 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
A zero header_size in a Microchip SPI FPGA bitstream causes an out-of-bounds read, potentially leaking memory or crashing the kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72156?
CVE-2026-72156 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start.
Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.
Which versions are affected by CVE-2026-72156?
How do I fix CVE-2026-72156?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72156 being exploited?
There is no known exploitation of CVE-2026-72156 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72156, DEBIAN-CVE-2026-72156, GHSA-46j9-hjxg-9ff5, UBUNTU-CVE-2026-72156.