# CVE-2026-40426: Intel NPU Driver integer underflow in Ring 3 user applications

Source: https://junglewise.ai/threats/cve-2026-40426-integer-underflow-wrap-or-wraparound-for-the-intel-r-npu-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-40426 · Severity: info · Published 2026-11-10

Intel's NPU Driver software contains an integer underflow vulnerability that allows unprivileged users to crash systems running the driver. An authenticated attacker with local access can exploit this flaw to cause a denial of service, disrupting operations on machines with Intel neural processing units. The attack requires minimal complexity and no user interaction beyond authentication.

Technologies: [Intel NPU Driver for Linux](https://junglewise.ai/threats/technologies/npu-driver-for-linux). Vendors: [Intel](https://junglewise.ai/threats/vendors/intel).

## Quick answers

**Is CVE-2026-40426 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40426 being exploited in the wild.

**How severe is CVE-2026-40426?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Intel NPU Driver for Linux before 1.33.0.

**Is there a fix for CVE-2026-40426?** Yes: fixed in NPU Driver for Linux 1.33.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40426 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-40426?** Check whether you run Intel NPU Driver for Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in NPU Driver for Linux 1.33.0

## Technical details

An integer underflow (wrap or wraparound) exists in Intel NPU Driver versions before 1.33.0 within Ring 3 user-space applications. The vulnerability requires local access, an authenticated user, and specific attack conditions; it allows denial of service via unprivileged execution. The flaw impacts system availability (high impact) with minor potential impacts on confidentiality and integrity (low impact), but secondary impacts are mitigated.

## Affected products

- Intel NPU Driver for Linux before 1.33.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html](https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01521.html)

## Related threats

- [Intel NPU Driver improper resource locking denial of service](https://junglewise.ai/threats/cve-2026-40705-improper-resource-locking-for-the-intel-r-npu-drivers-before)
- [Intel NPU Driver out-of-bounds read denial of service](https://junglewise.ai/threats/cve-2026-20786-intel-npu-driver-out-of-bounds-read-denial-of-service)
- [Intel NPU Driver improper conditions check in firmware](https://junglewise.ai/threats/cve-2026-20783-intel-npu-driver-improper-conditions-check-in-firmware)
- [Intel NPU Driver improper conditions check denial of service](https://junglewise.ai/threats/cve-2026-20769-intel-npu-driver-improper-conditions-check-denial-of-service)
- [Intel NPU Driver buffer restriction denial of service](https://junglewise.ai/threats/cve-2026-20731-intel-npu-driver-buffer-restriction-denial-of-service)