UnratedFix available
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault. Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.270, 5.15.221, 6.1.188, 6.12.109, 6.18.50, 6.6.157, 7.2.4
- CVEs
- CVE-2026-89730
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 00:55 UTC · Revision 1
Source evidence
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
core-osv · Original sourcePublished 11 Sept 2026, 19:46 UTC
In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault. Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.
osv:CVE-2026-89730
Kernel
Fixed versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
Complete source record
{
"id": "cb2db724f2ae9853cb483ac23196d4e90aad955b9003b40f971cf8db75b39c4c",
"url": "https://osv.dev/vulnerability/CVE-2026-89730",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write",
"summary": "In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault. Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer.",
"evidence": "osv:CVE-2026-89730",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.270",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.221",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.188",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.157",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.109",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.50",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-89730",
"aliases": [
"CVE-2026-89730"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "34d1dc17ce978ae76e676d401b48fe9d004aa948"
},
{
"fixed": "447b3c893987a0106a65f04b62ec3271892e9d98"
},
{
"fixed": "3b8938f5fbcf4a918785f9cb4b108782eb4ea717"
},
{
"fixed": "2564ac3d3b8b47cd9692a5bf42d668ed7218b54e"
},
{
"fixed": "8f3365ed2a5db2ac95ab70a6c47561db39d24537"
},
{
"fixed": "b138bc665e21d4422382ab43aebdf0a2b7bb9cb3"
},
{
"fixed": "827ec385458adeeda651de2b6f3537e386b1a8d9"
},
{
"fixed": "4dc1051939e499c838229af035464a5fc7671198"
},
{
"fixed": "9da70a43b5fea60d758137f7f0ccfe19356cb5bb"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89730.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.14.0"
},
{
"fixed": "5.10.270"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.221"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.188"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.157"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.109"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.50"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89730.json"
}
}
],
"modified": "2026-10-28T02:30:41.004439412Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/2564ac3d3b8b47cd9692a5bf42d668ed7218b54e",
"https://git.kernel.org/stable/c/3b8938f5fbcf4a918785f9cb4b108782eb4ea717",
"https://git.kernel.org/stable/c/447b3c893987a0106a65f04b62ec3271892e9d98",
"https://git.kernel.org/stable/c/4dc1051939e499c838229af035464a5fc7671198",
"https://git.kernel.org/stable/c/827ec385458adeeda651de2b6f3537e386b1a8d9",
"https://git.kernel.org/stable/c/8f3365ed2a5db2ac95ab70a6c47561db39d24537",
"https://git.kernel.org/stable/c/9da70a43b5fea60d758137f7f0ccfe19356cb5bb",
"https://git.kernel.org/stable/c/b138bc665e21d4422382ab43aebdf0a2b7bb9cb3",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89730.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-89730",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89730.json"
}
},
"related_cves": [
{
"value": "CVE-2026-89730",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 508742,
"published_at": "2026-09-11T19:46:40.581+00:00"
}