190 matches found
SUSE CVE-2026-97915
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...
CVE-2026-97917
A flaw was found in the Linux kernel's Intel Versatile Processing Unit ivpu accelerator driver. A local user could trigger an out-of-bounds memory access by supplying an address range that extends beyond the allocated buffer object boundaries. This issue can lead to memory corruption or a system...
CVE-2026-97916
A flaw was found in the Linux kernel's Intel VPU ivpu driver. A compromised device firmware can cause a Denial of Service DoS by modifying log buffer metadata in shared memory. Because the host driver re-reads buffer size fields from shared memory after validating them, the firmware can alter the...
CVE-2026-97915
A flaw was found in the Linux kernel's Intel Versatile Processing Unit accel/ivpu driver. The driver fails to verify that firmware-supplied log names are null-terminated before printing them. This issue causes an out-of-bounds memory read that can leak adjacent data from shared memory buffers int...
RLSA-2026:71700 Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: smb: smbdirect: introduce smbdirectsocket.recvio.credits.available CVE-2026-31539 kernel:...
CVE-2026-97917
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
CVE-2026-97915
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...
AZL-104315 CVE-2026-97917 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
AZL-104256 CVE-2026-97915 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...
DEBIAN-CVE-2026-97916
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...
DEBIAN-CVE-2026-97917
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
DEBIAN-CVE-2026-97915
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...
AZL-104789 CVE-2026-97916 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...
UBUNTU-CVE-2026-97915
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...
UBUNTU-CVE-2026-97917
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
UBUNTU-CVE-2026-97916
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...
EUVD-2026-86771
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
CVE-2026-97917 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
CVE-2026-97917
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...
CVE-2026-97917 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...