CVE-2026-89730 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault.
Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel's Altera FPGA configuration driver involves an out-of-bounds memory read within the altera_cvp_send_block function. This specific flaw occurs during the handling of trailing data that does not align to a standard word boundary, specifically when one to three bytes remain in the input buffer after processing complete 32-bit words. The root cause lies in the implementation's attempt to optimize write operations by treating memory as an array of unsigned 32-bit integers rather than individual bytes. When the driver encounters this final partial block, it dereferences a pointer cast to a u32 type and performs a four-byte read operation regardless of how many valid bytes actually remain in the buffer at that location.
This architectural oversight creates a critical security risk when the input data buffer is positioned such that its end coincides with or approaches a page boundary or scatterlist segment limit. In these scenarios, the memory address immediately following the last valid byte may reside outside the allocated kernel memory space or belong to an unmapped region. Consequently, attempting to read four bytes from this location triggers a general protection fault or a null pointer dereference exception within the kernel context. This results in an immediate denial of service condition for the system running the affected Linux kernel version, as the unhandled exception typically leads to a kernel panic and subsequent system reboot.
From a classification perspective, this vulnerability is categorized under CWE-125, which denotes Out-of-bounds Read. The flaw represents a classic buffer over-read scenario where the software fails to properly validate the length of data before performing memory access operations that assume fixed-size chunks. In terms of attack vectors and tactical behavior, this aligns with ATT&CK technique T1068, Exploitation for Privilege Escalation or Defense Evasion, although in this specific instance, the primary impact is stability rather than direct privilege escalation due to the nature of the fault being a crash rather than arbitrary code execution. However, if an attacker can control the memory layout and contents adjacent to the buffer through other means, such as heap spraying techniques combined with information leaks from prior vulnerabilities, they might potentially leverage this instability for more complex exploitation chains.
The operational impact is primarily focused on system availability. An unprivileged local user or a remote entity capable of triggering FPGA configuration via the Altera CVP interface can induce a kernel crash by providing carefully crafted input data that ends at an unsafe memory boundary. This disrupts critical services hosted on systems utilizing these specific FPGA components and requires administrative intervention to restore service through a system restart. There is no immediate evidence suggesting this flaw allows for arbitrary code execution or direct information disclosure, as the fault occurs during the read operation itself rather than allowing controlled writes to arbitrary addresses.
To mitigate this vulnerability, it is essential to apply the upstream kernel patch that modifies the altera_cvp_send_block function logic. The fix involves implementing a safe handling mechanism for trailing bytes by copying the remaining one to three valid bytes into a zero-initialized local u32 variable before performing the final write operation. This approach ensures that only memory addresses within the allocated and mapped buffer are accessed, thereby eliminating the possibility of reading past the end of the input data. System administrators should update their Linux kernels to versions containing this fix and ensure that FPGA configuration interfaces are restricted to trusted users where possible to reduce the attack surface for potential denial-of-service attempts.