Linux kernel IVPU Firmware Heap Overflow DoS

The vulnerability of the ivpufwparse function in the drivers/accel/ivpu/ivpufw.c file of the Linux kernel’s acceleration device driver relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

Linux kernel compute acceleration driver buffer overflow DoS

The vulnerability in the fwlogprintbuffer function within the drivers/accel/ivpu/ivpufwlog.c file of the Linux kernel’s compute acceleration driver is related to buffer overflow conditions. Exploitation of this vulnerability may allow an attacker to gain access to protected information or cause a...

Malicious code in @zalastax/nolb-ipu (npm)

The package @zalastax/nolb-ipu was found to contain malicious code. --- Credit: OpenSSF source...

kernel security, bug fix, and enhancement update

6.12.0-211.47.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

2026.3 IPU, Intel Chipset Firmware Advisory - Lenovo Support US

No description provided...

EUVD-2026-48791

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

backend-ai-accelerator-cuda-open (>=25.6.3, <=26.8.3), backend-ai-accelerator-graphcore-ipu (>=25.19.0, <=26.4.3) +6 more potentially affected by CVE-2026-59890 via setuptools (80.0.1)

setuptools PYPI version 80.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - backend-ai-accelerator-cuda-open =25.6.3, =25.19.0, =25.6.3, =25.6.3, =25.6.3, =25.6.3, =6.0.3, =6.0.4 Source cves: CVE-2026-59890 Source...

backend-ai-accelerator-cuda-open (>=25.6.3, <=26.8.3), backend-ai-accelerator-graphcore-ipu (>=25.19.0, <=26.4.3) +6 more potentially affected by CVE-2026-59890 via setuptools (80.0.1)

setuptools PYPI version 80.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - backend-ai-accelerator-cuda-open =25.6.3, =25.19.0, =25.6.3, =25.6.3, =25.6.3, =25.6.3, =6.0.3, =6.0.4 Source cves: CVE-2026-59890 Source...

CVE-2026-46313

In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp-psys is confirmed to be an error pointer not NULL so this condition is true and the error pointer is dereferenced. So isp-psys should be set to NULL before goin...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: ipu-bridge: Fixed the issue of NULL pointer dereferencing during SSDB/PLD parsing. When the functions ipubridgeparserotation and ipubridgeparseorientation are executed, sensor-adev is not set yet. Therefore, if either of...

ipu_bridge_connectSensor Heap Buffer Overflow DoS

The vulnerability of the ipubridgeconnectSensor function in the drivers/media/pci/intel/ipu-bridge.c file of the Linux multimedia device driver module is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-47384

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An error pointer dereference occurs in the intel/ipu6 media component. In a specific error path, the isp-psys variable is confirmed to be an error pointer rather than NULL, leading to a...

CVE-2025-14577: Missing Authentication for Critical Function

Slican NCP/IPL/IPM/IPU devices are vulnerable to PHP Function Injection. An unauthenticated remote attacker is able to execute arbitrary PHP commands by sending specially crafted requests to /webcti/sessionajax.php endpoint. This issue was fixed in version 1.24.0190 Slican NCP and 6.61.0010 Slica...

PT-2026-37517

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A runtime power management RPM reference leak exists in the Linux kernel. In the ipu6 pci probe function, several error paths jump directly to out ipu6 bus del devices without releasing...

Linux Distros Unpatched Vulnerability : CVE-2023-53537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free for cached IPU bio xfstest generic/019 reports a bug: kern...

CVE-2023-53537 f2fs: fix to avoid use-after-free for cached IPU bio

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free for cached IPU bio xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619! RIP: 0010:folioendwriteback+0x8a/0x90 Call Trace: endpagewriteback+0x1c/0x60 f2fswriteendio+0x199/0x420...

CVE-2023-53537

Summary: CVE-2023-53537 concerns a Linux kernel F2FS use-after-free involving a cached IPU bio. Root cause: after cp_error is set, f2fs_submit_merged_ipu_write() failed to validate the bio parameter in f2fs_write_single_data_page(), leading to submission of a random cached bio from another IO con...

CVE-2023-53537: Use After Free

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free for cached IPU bio xfstest generic/019 reports a bug: kernel BUG at mm/filemap.c:1619! RIP: 0010:folioendwriteback+0x8a/0x90 Call Trace: endpagewriteback+0x1c/0x60 f2fswriteendio+0x199/0x420...

Linux Distros Unpatched Vulnerability : CVE-2023-53336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings When...

SUSE CVE-2023-53336

In the Linux kernel, the following vulnerability has been resolved: media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings When ipubridgeparserotation and ipubridgeparseorientation run sensor-adev is not set yet. So if either of the devwarn calls about unknown values are hit this...