{"id":"CVE-2026-89730","title":"fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: altera-cvp: Avoid out-of-bounds read in trailing byte write\n\nThe trailing byte path in altera_cvp_send_block() dereferences a u32\npointer even when only 1-3 bytes…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 447b3c893987a0106a65f04b62ec3271892e9d98","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 3b8938f5fbcf4a918785f9cb4b108782eb4ea717","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 2564ac3d3b8b47cd9692a5bf42d668ed7218b54e","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 8f3365ed2a5db2ac95ab70a6c47561db39d24537","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < b138bc665e21d4422382ab43aebdf0a2b7bb9cb3","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 827ec385458adeeda651de2b6f3537e386b1a8d9","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 4dc1051939e499c838229af035464a5fc7671198","Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 9da70a43b5fea60d758137f7f0ccfe19356cb5bb","Linux 4.14"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:51:43.578Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89730","references":[{"url":"https://git.kernel.org/stable/c/447b3c893987a0106a65f04b62ec3271892e9d98"},{"url":"https://git.kernel.org/stable/c/3b8938f5fbcf4a918785f9cb4b108782eb4ea717"},{"url":"https://git.kernel.org/stable/c/2564ac3d3b8b47cd9692a5bf42d668ed7218b54e"},{"url":"https://git.kernel.org/stable/c/8f3365ed2a5db2ac95ab70a6c47561db39d24537"},{"url":"https://git.kernel.org/stable/c/b138bc665e21d4422382ab43aebdf0a2b7bb9cb3"},{"url":"https://git.kernel.org/stable/c/827ec385458adeeda651de2b6f3537e386b1a8d9"},{"url":"https://git.kernel.org/stable/c/4dc1051939e499c838229af035464a5fc7671198"},{"url":"https://git.kernel.org/stable/c/9da70a43b5fea60d758137f7f0ccfe19356cb5bb"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89730.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89730"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532368"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89730"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89730"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89730.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00216,"epssPercentile":0.12005,"ingestedAt":"2026-09-14T15:23:07.449Z","slug":"CVE-2026-89730","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfpga: altera-cvp: Avoid out-of-bounds read in trailing byte write\n\nThe trailing byte path in altera_cvp_send_block() dereferences a u32\npointer even when only 1-3 bytes remain in the input buffer. If the buffer\nends at a page or scatterlist boundary, this can read past the valid image\ndata and fault.\n\nCopy the remaining bytes into a zero-initialized u32 before writing the\nfinal word so only valid bytes are read from the input buffer.\n\n## Affected\n\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 447b3c893987a0106a65f04b62ec3271892e9d98`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 3b8938f5fbcf4a918785f9cb4b108782eb4ea717`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 2564ac3d3b8b47cd9692a5bf42d668ed7218b54e`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 8f3365ed2a5db2ac95ab70a6c47561db39d24537`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < b138bc665e21d4422382ab43aebdf0a2b7bb9cb3`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 827ec385458adeeda651de2b6f3537e386b1a8d9`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 4dc1051939e499c838229af035464a5fc7671198`\n- `Linux >= 34d1dc17ce978ae76e676d401b48fe9d004aa948 < 9da70a43b5fea60d758137f7f0ccfe19356cb5bb`\n- `Linux 4.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89730.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205479,"id":"CVE-2026-89730","ts":1789576721682,"field":"cvss","old":"4.4","new":"5.5"},{"seq":203978,"id":"CVE-2026-89730","ts":1789490230885,"field":"cvss","old":null,"new":"4.4"},{"seq":203977,"id":"CVE-2026-89730","ts":1789490230885,"field":"severity","old":"none","new":"medium"},{"seq":147303,"id":"CVE-2026-89730","ts":1789270208360,"field":"cvss","old":null,"new":"4.4"},{"seq":147302,"id":"CVE-2026-89730","ts":1789270208360,"field":"severity","old":"none","new":"medium"},{"seq":109060,"id":"CVE-2026-89730","ts":1789183730152,"field":"cvss","old":null,"new":"4.4"},{"seq":109059,"id":"CVE-2026-89730","ts":1789183730152,"field":"severity","old":"none","new":"medium"}]}