CVE-2026-89730: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
In the Linux kernel, the following vulnerability has been resolved:
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
The trailing byte path in alteracvpsendblock() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault.
Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds read?
The vulnerable trailing-byte path is reached when altera_cvp_send_block() processes input whose final portion contains only 1 to 3 bytes. The read can extend beyond valid image data when that buffer ends at a page or scatterlist boundary.
What is the practical impact of this issue?
The invalid read can fault while the final word is being written, potentially interrupting the FPGA image transfer operation. The provided data describes an out-of-bounds read; it does not establish further impact.
How does the fix mitigate the problem?
The fix copies the remaining 1 to 3 bytes into a zero-initialized u32 before writing the final word. This ensures that only bytes within the valid input buffer are read.