All vulnerabilities
CVE-2026-97916

Linux: accel/ivpu: Validate firmware log buffer metadata

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in07d4190d75021c38b7994045179aa29131634d4fAlso 8ec3d6972f1440fae6c8dadd1859892775208759, 40868f80a89199630b03d4457876f9a1feba0660 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 07d4190d75021c38b7994045179aa29131634d4fLinuxCVE List
  • 8ec3d6972f1440fae6c8dadd1859892775208759LinuxCVE List
  • 40868f80a89199630b03d4457876f9a1feba0660LinuxCVE List
  • 0724afc55c77c36c7feb9a7264b02aa7593c5c2dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Validate firmware log buffer metadata

The tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared BOs that the NPU firmware can write to.

fw_log_from_bo() validated log->header_size and log->size, but fw_log_print_buffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs.

Snapshot the validated values once with READ_ONCE() and pass them down explicitly in a new struct ivpu_fw_log_desc instead of re-reading them from the shared struct.

Text from CVE List

Affected versions 12

  • Linuxaffected: d4e4257afa6ed5205eda993180401fc2c20e4b60 before 07d4190d75021c38b7994045179aa29131634d4fCVE List
  • Linuxaffected: d4e4257afa6ed5205eda993180401fc2c20e4b60 before 8ec3d6972f1440fae6c8dadd1859892775208759CVE List
  • Linuxaffected: d4e4257afa6ed5205eda993180401fc2c20e4b60 before 40868f80a89199630b03d4457876f9a1feba0660CVE List
  • Linuxaffected: d4e4257afa6ed5205eda993180401fc2c20e4b60 before b1555f63ee1a680f280bc18e8dac416f250e2ec3CVE List
  • Linuxaffected: d4e4257afa6ed5205eda993180401fc2c20e4b60 before 0724afc55c77c36c7feb9a7264b02aa7593c5c2dCVE List
  • Linuxaffected: 6.6CVE List
  • Linuxunaffected: all versions before 6.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5