CVE-2026-89730

What it actually does

Out-of-bounds read in altera_cvp_send_block() when a trailing partial u32 (1-3 bytes) at a page or scatterlist boundary is dereferenced as a full 32-bit word, allowing access beyond the valid input buffer.

Why it matters to the business

Systems using Altera FPGA devices with CVP programming may experience kernel faults, crashes, or limited memory disclosure during FPGA bitstream loading, potentially affecting device initialization and availability.

How an attack unfolds

An attacker supplies a crafted FPGA image or triggers the driver path with a buffer ending at a page boundary containing only 1-3 trailing bytes; the kernel code then reads past the end of the buffer, which can fault or leak adjacent memory contents.

How to fix it

Apply the upstream kernel patch that copies remaining bytes into a zero-initialized u32 before the final write; rebuild and deploy updated kernels containing the fix for altera-cvp.

How to confirm the fix worked

Confirm the patch is present by inspecting altera_cvp_send_block() for the zero-initialized temporary buffer copy logic; test with FPGA images that end on page boundaries containing partial trailing words.

Typical attack path

1. Identify a system exposing the altera-cvp FPGA driver
2. Prepare a malicious or malformed FPGA configuration image sized to leave 1-3 bytes at a page/scatterlist boundary
3. Invoke altera_cvp_send_block() via the driver interface
4. Trigger the trailing-byte code path to cause the out-of-bounds read

How to detect it

Review kernel logs and dmesg for page faults or oopses referencing altera_cvp_send_block; inspect driver source or binary for presence of the boundary-handling copy before the final write.

What your security team should do

• Prioritize kernel updates on any hosts using Altera CVP FPGA programming
• Restrict unprivileged access to FPGA configuration interfaces until patched
• Monitor kernel logs for oops or page-fault messages originating from altera-cvp