CVE-2026-72156

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the mpf ops parse header() function within the microchip-spi FPGA component. The function reads the header size from the bitstream at the MPF HEADER SIZE OFFSET (24). If header size is zero, the system attempts to read one byte before the start of the buffer. This occurs because the expression *(buf + header size - 1) results in a negative offset when header size is zero.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.