Answer in brief
CVE-2026-72156 records a Unknown severity vulnerability in fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72156 records a Unknown severity vulnerability in fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5f8d4a9008307e0bf210906948953386935d361c <e45ec24d8e986d79a8e07f49a816c414ad283622 || >=5f8d4a9008307e0bf210906948953386935d361c <0d3766fecd9b2db39a18b48021c15c522997ec25 || >=5f8d4a9008307e0bf210906948953386935d361c <a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf || >=5f8d4a9008307e0bf210906948953386935d361c <c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f || >=5f8d4a9008307e0bf210906948953386935d361c <3da8eaf5469eda2353b72038d644fabddb848ce1 || >=5f8d4a9008307e0bf210906948953386935d361c <43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 | e45ec24d8e986d79a8e07f49a816c414ad283622, 0d3766fecd9b2db39a18b48021c15c522997ec25, a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf, c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f, 3da8eaf5469eda2353b72038d644fabddb848ce1, 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 |
| Linux/Linuxgeneric | 6.0 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5f8d4a9008307e0bf210906948953386935d361c <e45ec24d8e986d79a8e07f49a816c414ad283622 || >=5f8d4a9008307e0bf210906948953386935d361c <0d3766fecd9b2db39a18b48021c15c522997ec25 || >=5f8d4a9008307e0bf210906948953386935d361c <a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf || >=5f8d4a9008307e0bf210906948953386935d361c <c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f || >=5f8d4a9008307e0bf210906948953386935d361c <3da8eaf5469eda2353b72038d644fabddb848ce1 || >=5f8d4a9008307e0bf210906948953386935d361c <43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 | e45ec24d8e986d79a8e07f49a816c414ad283622, 0d3766fecd9b2db39a18b48021c15c522997ec25, a1baee24df72ec8fd1d6925c1d5162ffff4ee3bf, c9ef79e34bc1eac4fd59051e5c7b96a74e59d46f, 3da8eaf5469eda2353b72038d644fabddb848ce1, 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 |
| Linux/Linuxgeneric | 6.0 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.
Quoted source text, attributed separately from HOL analysis.