Executive brief
A vulnerability was identified in the Linux kernel's Intel VPU (Versatile Processing Unit) driver. The driver failed to properly verify the size of data returned by the device firmware during metric stream queries, which could lead to a buffer overflow. This could potentially allow a local attacker to cause a system crash or gain unauthorized access to memory.
Technical details
A buffer overflow vulnerability exists in the Linux kernel's accel/ivpu driver within the ivpu_ms_get_info_ioctl function in drivers/accel/ivpu/ivpu_ms.c. The issue stems from a lack of validation where the info_size returned from a metric stream info query is not checked against the allocated buffer object (BO) size before a buffer copy operation. An attacker could potentially exploit this if the firmware (or a compromised firmware) returns a size larger than the allocated buffer, leading to an out-of-bounds write. The fix introduces a check that rejects the operation with -EOVERFLOW if the returned size exceeds the buffer capacity.
Affected products
- Linux Linux 6.11 to 6.12.94, 6.18 to 6.18.36, 7.0 to 7.0.13
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory