CVE-2026-97917 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

CVE-2026-97917 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

CVE-2026-97917

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

CVE-2026-97917

The Linux kernel contains a vulnerability in the accel/ivpu component. The issue stems from a lack of range validation in the ivpu_to_cpu_addr function. To resolve this, a size parameter was added to ensure that the entire range from vpu_addr to vpu_addr + size remains within the buffer object (B...

CVE-2026-97915 accel/ivpu: Limit firmware log name prints to field size

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

EUVD-2026-86770

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

CVE-2026-97916 accel/ivpu: Validate firmware log buffer metadata

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

CVE-2026-97916 accel/ivpu: Validate firmware log buffer metadata

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

EUVD-2026-86769

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

CVE-2026-97915

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

CVE-2026-97916

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

CVE-2026-97915 accel/ivpu: Limit firmware log name prints to field size

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

CVE-2026-97915

The Linux kernel contains a vulnerability in the accel/ivpu component where the name field in struct vpu_tracing_buffer_header is populated by the NPU firmware. Because the host side does not enforce NUL-termination on this fixed-size array, using an unbounded string conversion can lead to an out...

CVE-2026-97916

The Linux kernel contains a vulnerability in the accel/ivpu driver related to how firmware log buffer metadata is handled. The tracing log headers are stored in DMA-shared Buffer Objects (BOs) , which the NPU firmware can modify. While fw_log_from_bo() validates the header_size and size fields, f...

kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl

A flaw was found in the Linux kernel's accel/ivpu component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability ...

CVE-2026-97915: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

CVE-2026-97917: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

CVE-2026-97916: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

CVE-2026-97916

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

PT-2026-98580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ivpu component where tracing log headers parsed by the fw log print buffer function reside in DMA-shared Buffer Objects BOs writable by the NPU firmware...