CVE-2026-72158: fpga: dfl: add bounds check in dfh_get_param_size()
Vulnerability summary
CVE-2026-72158 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities.
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 15-08-2026PublishedVulnerability first disclosed.
- 17-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfh_get_param_size() dfh_get_param_size() can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP (End of Parameters) bit is set in the same iteration, the inflated size is returned without re-validation against max. This can cause create_feature_instance() to call memcpy_fromio() with a size exceeding the ioremap'd region when a malicious FPGA device provides crafted DFHv1 parameter headers. Add a bounds check after the size increment to ensure the accumulated size never exceeds the feature boundary.
CVSS metrics
Risk metrics not yet published.
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.21% on 06-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: not stated in public data.
Ubuntu142 products
- linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-38.38
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1014.14
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian1 product
- linux< 6.12.100-1 | < 7.1.5-1
Linux1 product
- linux≥ 4747ab89b4a652f835494fcf8342aaa0efb9b0fd, < b2f6220e929b2a43605331d0139e65dc1640c05c | ≥ 4747ab89b4a652f835494fcf8342aaa0efb9b0fd, < 3b622aa447cf26104f96a8be39539367863bc6b6 | ≥ 4747ab89b4a652f835494fcf8342aaa0efb9b0fd, < 012683accbb7d2bcf1264f2a0ecd6aa1dcea4d68 | ≥ 4747ab89b4a652f835494fcf8342aaa0efb9b0fd, < f3df5386e3bb54626c117bd85e0158d45fb4aea9 | ≥ 4747ab89b4a652f835494fcf8342aaa0efb9b0fd, < 9e8bc49f91f3f81d957c4f1c1f09fe94e2f88f6a | 6.3
3 vendors · 144 products
