In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://git.kernel.org/stable/c/0d3766fecd9b2db39a18b48021c15c522997ec25 cve-icon cve-icon
https://git.kernel.org/stable/c/3da8eaf5469eda2353b72038d644fabddb848ce1 cve-icon cve-icon
https://git.kernel.org/stable/c/43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 cve-icon cve-icon
https://git.kernel.org/stable/c/a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf cve-icon cve-icon
https://git.kernel.org/stable/c/c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f cve-icon cve-icon
https://git.kernel.org/stable/c/e45ec24d8e986d79a8e07f49a816c414ad283622 cve-icon cve-icon
History

Sat, 15 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-787

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.
Title fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:53:25.979Z

Reserved: 2026-08-09T03:40:39.909Z

Link: CVE-2026-72156

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:33.373

Modified: 2026-08-15T06:21:33.373

Link: CVE-2026-72156

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T09:30:04Z