Executive brief
The Linux kernel's Device Feature Header (DFH) driver contains a bounds checking flaw in parameter size validation. A malicious or misconfigured FPGA device could trigger an out-of-bounds memory read by providing crafted DFHv1 parameter headers, causing the kernel to read memory beyond the allocated I/O mapped region and potentially exposing sensitive kernel data or causing a denial of service.
Technical details
The dfh_get_param_size() function in drivers/fpga/dfl.c has an off-by-one bounds check flaw where the loop condition is evaluated before the size is incremented. If the End of Parameters (EOP) bit is set in the same iteration, the accumulated size exceeds the feature region boundary without re-validation. This allows an attacker with the ability to control FPGA device parameter headers (adjacent network access, or physical FPGA device control) to cause create_feature_instance() to call memcpy_fromio() with a size parameter that exceeds the ioremap'd memory region, resulting in out-of-bounds reads. The fix adds a bounds check immediately after the size increment to prevent the accumulated size from exceeding the feature boundary. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel 5.0 and later (exact affected versions depend on DFHv1 support introduction in commit 4747ab89b4a6)
Timeline
- 2026-08-15: disclosed: CVE-2026-72158 published
- 2026-05-18: patched: Fix authored by Sebastian Alba Vives
- 2026-07-24: patched: Patch merged into stable kernel trees by Greg Kroah-Hartman