CVE-2026-72158

A flaw was found in the Linux kernel's FPGA Dynamic Function Link (DFL) subsystem. A malicious FPGA device can provide specially crafted parameter headers, causing the system to miscalculate the size of a feature region. This incorrect size can lead to a memory corruption vulnerability when data is copied, potentially resulting in a denial of service (DoS) for the system.

This vulnerability is rated as Moderate because triggering the condition requires local privileges or direct access to connect specialized FPGA hardware, and the resulting memory corruption is primarily bounded to a denial of service. Exploitation relies on an adversary presenting malformed DFHv1 parameter headers from a physical or emulated FPGA device to induce an out-of-bounds copy in kernel space. Because this functionality was introduced in newer upstream kernels, standard Red Hat Enterprise Linux releases do not include the vulnerable code and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.