CVE-2026-72158
Received Received - Intake

Bounds Check Bypass in Linux Kernel FPGA DFL Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh_get_param_size() dfh_get_param_size() can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP (End of Parameters) bit is set in the same iteration, the inflated size is returned without re-validation against max. This can cause create_feature_instance() to call memcpy_fromio() with a size exceeding the ioremap'd region when a malicious FPGA device provides crafted DFHv1 parameter headers. Add a bounds check after the size increment to ensure the accumulated size never exceeds the feature boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72158
EUVD
EUVD-2026-58916

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in the Linux kernel's FPGA driver where a function called dfh_get_param_size() can return an incorrect parameter size larger than the available memory region. This happens because the size calculation loop checks bounds before incrementing, allowing a malicious FPGA device to craft parameter headers that inflate the size. The function then passes this oversized value to memcpy_fromio(), which could read or write outside the intended memory area.

Detection Guidance

This vulnerability affects the Linux kernel's FPGA driver (dfl). Detection requires checking kernel logs for FPGA-related errors or examining the kernel version for the patched code. Commands like dmesg | grep -i fpga or uname -r may help identify affected systems.

Impact Analysis

This vulnerability could allow an attacker with access to a malicious FPGA device to cause memory corruption, crashes, or potentially execute arbitrary code in the Linux kernel. If exploited, it may lead to system instability, privilege escalation, or denial of service on affected systems.

Mitigation Strategies

Update the Linux kernel to the latest version that includes the fix for CVE-2026-72158. If immediate patching is not possible, disable FPGA device access or restrict untrusted FPGA devices until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart