CVE-2026-97917

The Linux kernel contains a vulnerability in the accel/ivpu component. The issue stems from a lack of range validation in the ivpu_to_cpu_addr function. To resolve this, a size parameter was added to ensure that the entire range from vpu_addr to vpu_addr + size remains within the buffer object (B...

CVE-2026-97916

The Linux kernel contains a vulnerability in the accel/ivpu driver related to how firmware log buffer metadata is handled. The tracing log headers are stored in DMA-shared Buffer Objects (BOs) , which the NPU firmware can modify. While fw_log_from_bo() validates the header_size and size fields, f...

CVE-2026-97915

The Linux kernel contains a vulnerability in the accel/ivpu component where the name field in struct vpu_tracing_buffer_header is populated by the NPU firmware. Because the host side does not enforce NUL-termination on this fixed-size array, using an unbounded string conversion can lead to an out...

kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl

A flaw was found in the Linux kernel's accel/ivpu component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability ...

kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl

A flaw was found in the Linux kernel's accel/ivpu component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability ...

CVE-2026-72089 accel/ivpu: Reject firmware log with size smaller than header

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

CVE-2026-72089 accel/ivpu: Reject firmware log with size smaller than header

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

PT-2026-72278

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw log from bo validates the tracing buffer header size and that the log fits within the BO, but never checks that log-size is at least log-header size. fw log print...

CVE-2026-72089: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

kernel security, bug fix, and enhancement update

5.14.0-687.39.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

kernel: Kernel: Privilege escalation and denial of service via integer truncation in accel/ivpu

A flaw was found in the Linux kernel's accel/ivpu component. A local attacker could exploit a signed integer truncation vulnerability in the Inter-Process Communication IPC receive path. This flaw occurs when a firmware-supplied data size is incorrectly converted, leading to an oversized memory...

CVE-2026-53206

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized to hold the firmware image. This prevents errors during memory...

Linux Distros Unpatched Vulnerability : CVE-2026-53202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware- supplied datasize is cast to signed int before being used...

Linux Distros Unpatched Vulnerability : CVE-2026-53205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds datasize...

Linux Distros Unpatched Vulnerability : CVE-2026-53206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime...

Linux Distros Unpatched Vulnerability : CVE-2026-53203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Add buffer overflow check in MS getinfoioctl Add validation that the info size returned from the metric stream info query is not exceeded when check...

SUSE CVE-2026-53205

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds datasize before using them. If out-of-bounds indices are encountered from...

CVE-2026-53203

A flaw was found in the Linux kernel's accel/ivpu component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability ...

UBUNTU-CVE-2026-53202

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied datasize is cast to signed int before being used in mint. Large unsigned values = 0x80000000 become negative, causing...

UBUNTU-CVE-2026-53206

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds check for firmware runtime memory Validate that the firmware runtime memory specified in the image header is properly aligned and sized to hold the firmware image. This prevents errors during memory...