Executive brief
A vulnerability in the Linux kernel's acceleration driver for Intel VPU devices could allow a malicious or compromised firmware to cause a system crash. By providing an unexpectedly large data size value, the firmware can trigger a memory error that overflows internal buffers. This primarily impacts the stability and security of systems using specific Intel AI acceleration hardware.
Technical details
A vulnerability exists in the accel/ivpu driver within the ivpu_ipc.c component of the Linux kernel. The root cause is a signed integer truncation where a firmware-supplied 'data_size' (u32) is cast to a signed int via the min_t() macro. If the firmware provides a value greater than or equal to 0x80000000, it is treated as a negative number, causing the min_t() check to fail and resulting in an oversized memcpy() operation. This leads to a stack-based buffer overflow. The issue has been resolved by replacing min_t(int, ...) with the min() macro to ensure unsigned comparison.
Affected products
- Linux Linux Kernel 6.8 to 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-06-01: patched: Initial patch authored
- 2026-06-25: advisory: CVE published by NVD