Executive brief
A vulnerability in the Linux kernel's Intel VPU (ivpu) driver could allow for data corruption or incorrect device access. The issue stems from how the system handles memory buffers used for hardware acceleration. If an attacker or a malfunctioning program re-exports certain memory objects, it can lead to a loss of security and configuration flags, potentially compromising the stability or integrity of the system's data.
Technical details
A vulnerability was identified in the Linux kernel's accel/ivpu driver where imported Graphics Execution Manager (GEM) objects could be re-exported. This occurred because the driver lacked a custom prime_handle_to_fd callback to validate the origin of the buffer. When an imported GEM buffer is re-exported, its associated buffer flags are lost. This loss of metadata can result in the device accessing memory with incorrect parameters, leading to data corruption. The fix introduces a check using drm_gem_is_imported() within a new ivpu_gem_prime_handle_to_fd callback to return -EOPNOTSUPP when a re-export is attempted.
Affected products
- Linux Linux Kernel v6.19+
Timeline
- 2026-04-30: patched: Initial patch authored by Karol Wachowski
- 2026-05-21: disclosed: CVE published to NVD