CVE-2026-20786

Out-of-bounds read for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local...

CVE-2026-20786

CVE-2026-20786 describes an out-of-bounds read in the Intel(R) NPU Driver affecting all Ring 3 (user) versions. An unprivileged authenticated user with local access and low attack complexity may cause denial of service, with potential impact on integrity (low) and availability (high); confidentia...

CVE-2026-20783

The CVE-2026-20783 entry concerns the Intel NPU Driver firmware with an improper conditions check affecting all versions within Ring 1: Device Drivers. The vulnerability can allow a local, authenticated user with low privileges and low attack complexity to cause a denial of service without user i...

EUVD-2026-56498

Improper conditions check in the firmware for the IntelR NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may...

CVE-2026-20783

Improper conditions check in the firmware for the IntelR NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may...

EUVD-2026-56492

Improper conditions check for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via...

CVE-2026-20769

Improper conditions check for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via...

CVE-2026-20769

The CVE-2026-20769 entry concerns the Intel(R) NPU Driver. Affected component: Intel NPU Driver operating in Ring 3 (user applications). Issue: improper conditions check could allow a denial of service by an unprivileged, authenticated user with low attack complexity; attack vector is local. Impa...

CVE-2026-20731

Improper buffer restrictions for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur...

CVE-2026-20731

CVE-2026-20731 describes an issue in the Intel(R) NPU Driver affecting all versions within Ring 3: User Applications may allow a denial of service. A low-privilege, authenticated user (local attacker) could trigger a DoS with a low-complexity attack and no user interaction. The advisory indicates...

EUVD-2026-56479

Improper buffer restrictions for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur...

PT-2026-70304

Improper conditions check in the firmware for the IntelR NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may...

PT-2026-70298

Improper conditions check for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via...

PT-2026-70285

Name of the Vulnerable Software and Affected Versions IntelR NPU Driver affected versions not specified Description Improper buffer restrictions within Ring 3 the least privileged level of the CPU architecture for User Applications may allow a denial of service. An unprivileged software adversary...

Intel® NPU Driver Advisory

Summary: Potential security vulnerabilities for some Intel® NPU Drivers may allow denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2026-20731 Description: Improper buffer restrictions for the Intel® NPU Driver fo...

Intel NPU Driver August 2026 Security Update

Intel has informed HP of potential vulnerabilities identified for some Intel® NPU Drivers, which might allow denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Intel has released updates to mitigate the potential vulnerabilities. HP has identified...

PT-2026-70305

Out-of-bounds read for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local...

PT-2026-70318

Time-of-check time-of-use race condition for the IntelR NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result...

CVE-2026-68330

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

UBUNTU-CVE-2026-68330

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...