CVE-2026-72156

A flaw was found in the Linux kernel's microchip-spi Field-Programmable Gate Array (FPGA) module. This vulnerability occurs in the mpf_ops_parse_header() function when processing a bitstream. If a crafted bitstream sets the header_size to zero, the function attempts to read data from memory before the allocated buffer, leading to an out-of-bounds read. This could potentially allow a local attacker to gain access to sensitive information or cause a denial of service.

This vulnerability is rated as Moderate impact because triggering the out-of-bounds read requires local access with administrative privileges to supply crafted bitstream data to the FPGA manager. Potential consequences are limited to local denial of service or information disclosure, and exploitation strictly depends on systems configured with specific Microchip SPI FPGA hardware. Furthermore, Red Hat Enterprise Linux releases are not affected as the vulnerable driver code is not present in shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.