Executive brief
A vulnerability in the Linux kernel's Intel VPU (Versatile Processing Unit) driver could allow for improper memory access. The driver failed to verify that log indices provided by the device firmware were within the expected range, which could lead to system instability or crashes. This affects systems using specific Intel acceleration hardware.
Technical details
An out-of-bounds read vulnerability existed in the 'accel/ivpu' driver within 'drivers/accel/ivpu/ivpu_fw_log.c'. The 'fw_log_print_buffer' function failed to validate that 'read_index' and 'write_index' values supplied by the firmware were within the 'data_size' bounds of the log buffer. A malicious or malfunctioning firmware could provide indices exceeding the buffer size, leading to out-of-bounds memory access. The fix introduces explicit bounds checking and clamps invalid indices to safe values (0 or data_size) before they are used as offsets. This issue is primarily reachable by local attackers with the ability to influence firmware-to-host communication or in scenarios involving compromised firmware.
Affected products
- Linux Linux Kernel 6.12.30 to 6.12.94, 6.13, 6.18+
Timeline
- 2026-05-29: other: Patch authored
- 2026-06-25: advisory: CVE published by NVD