EUVD-2026-45624

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

EUVD-2026-45581

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-53206

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized to hold the firmware image. This prevents errors during memory...

Linux Distros Unpatched Vulnerability : CVE-2026-53206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized t...

Linux Distros Unpatched Vulnerability : CVE-2026-53202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware- supplied datasize is cast to signed int before being used...

Linux Distros Unpatched Vulnerability : CVE-2026-53205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds datasize...

Linux Distros Unpatched Vulnerability : CVE-2026-53203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Add buffer overflow check in MS getinfoioctl Add validation that the info size returned from the metric stream info query is not exceeded when check...

CVE-2026-53171

A flaw was found in the Linux kernel's accel/ethosu driver. The dmalength function, responsible for calculating Direct Memory Access DMA region usage, contains several arithmetic issues. These issues, including potential underflows and overflows during calculations, can lead to an under-reporting...

CVE-2026-53173

A flaw was found in the Linux kernel's accel/ethosu component. A local user can exploit this vulnerability by providing a specially crafted command stream, which causes an out-of-bounds write in memory. This memory corruption can lead to system instability, causing a denial of service or...

CVE-2026-53169

A flaw was found in the Linux kernel's accel/ethosu driver. An unprivileged local user with access to the Direct Rendering Manager DRM device could submit a specific command NPUOPRESIZE that the driver does not properly handle. This could lead to excessive kernel log spam and, if the paniconwarn...

SUSE CVE-2026-53205

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds datasize before using them. If out-of-bounds indices are encountered from...

CVE-2026-53203

A flaw was found in the Linux kernel's accel/ivpu component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability ...

CVE-2026-53170

A flaw was found in the Linux kernel's accel/ethosu driver. A local attacker could exploit a vulnerability where DMA commands with uninitialized length are not properly handled. By omitting a specific DMA length setup command and issuing a DMA start command, a user could bypass bounds checks,...

UBUNTU-CVE-2026-53202

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied datasize is cast to signed int before being used in mint. Large unsigned values = 0x80000000 become negative, causing...

UBUNTU-CVE-2026-53206

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized to hold the firmware image. This prevents errors during memory...

CVE-2026-53206

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized to hold the firmware image. This prevents errors during memory...

CVE-2026-53205

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds datasize before using them. If out-of-bounds indices are encountered from...

CVE-2026-53205

The CVE-2026-53205 issue is in the Linux kernel Intel Versatile Processing Unit (IVPU) accelerator driver (accel/ivpu). It stems from insufficient validation of read/write indices in the firmware log buffer, allowing potential out-of-bounds access if firmware supplies invalid indices. Affected sy...

EUVD-2026-39294

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS getinfoioctl Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buffer size. If the firmware returns a size...

CVE-2026-53202 accel/ivpu: Fix signed integer truncation in IPC receive

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied datasize is cast to signed int before being used in mint. Large unsigned values = 0x80000000 become negative, causing...