mpf_ops_parse_header() in the Linux fpga:microchip‑spi driver reads the header_size field from a bitstream offset. When the value is zero, the calculation *(buf + header_size - 1) reads a byte one position before the buffer start, causing an out‑of‑bounds read that can expose arbitrary kernel memory. The flaw does not modify device state or execute code, but it allows information disclosure, and it is classified as CWE‑125.

Any Linux kernel that includes the unpatched fpga:microchip‑spi driver is vulnerable. This includes standard distribution kernels and custom builds that have not applied the commit adding the zero‑header_size guard. The kernel version range is unspecified, so any build before the operating commit is impacted.

The CVSS score of 5.5 denotes moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in typical production environments. The vulnerability is not listed in CISA’s KEV catalog. Exploit requires a crafted FPGA bitstream processed by the driver, implying a local or privileged attack vector. While the vulnerability alone only leaks data, it could serve as a foothold for further compromise if an attacker gains access to sensitive kernel memory.