The Linux kernel's fpga microchip-spi driver contained a vulnerability (CVE-2026-72156) where the mpf_ops_parse_header() function reads the header_size from the bitstream at a fixed offset. If header_size is zero, the expression *(buf + header_size - 1) results in an out-of-bounds read one byte before the buffer start. Although the buffer size is guaranteed to be large enough for normal header sizes, the zero header_size case was not handled properly. The vulnerability was fixed by returning -EINVAL when header_size is zero, preventing the out-of-bounds read.

This vulnerability could lead to an out-of-bounds read in kernel memory when processing FPGA bitstreams with a zero header_size. While the exact impact is not detailed, out-of-bounds reads can potentially lead to information disclosure or kernel instability. No known exploits in the wild have been reported.

A fix is available that returns an error when header_size is zero, preventing the out-of-bounds read. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation.