Medium [CVE-2026-72156] fix zero header_size OOB read in mpf_ops_parse_header

In the Linux kernel, the following vulnerability has been resolved: fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start.

Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL.

A flaw was found in the Linux kernel's microchip-spi Field-Programmable Gate Array (FPGA) module. This vulnerability occurs in the `mpf_ops_parse_header()` function when processing a bitstream.

If a crafted bitstream sets the `header_size` to zero, the function attempts to read data from memory before the allocated buffer, leading to an out-of-bounds read. This could potentially allow a local attacker to gain access to sensitive information or cause a denial of service.

Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-125.

Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.