Executive brief
A vulnerability was identified in the Linux kernel's Intel VPU (Vision Processing Unit) driver. The driver failed to properly check the size and alignment of memory requested by firmware, which could lead to errors during memory allocation or data transfer. This issue primarily affects systems using specific Intel acceleration hardware.
Technical details
A vulnerability in the accel/ivpu driver within the Linux kernel stemmed from a lack of validation for firmware runtime memory parameters. Specifically, the driver did not verify that the runtime memory address and size specified in the firmware image header were page-aligned or large enough to contain the firmware image itself. An attacker or a malformed firmware image could trigger memory allocation errors or issues during image transfer. The fix introduces explicit checks using PAGE_ALIGNED() and ensures runtime_size is at least as large as image_size in ivpu_fw_parse(). Patches have been applied to stable branches including 7.0.13 and 7.1.
Affected products
- Linux Linux Kernel 6.19, 7.0.x before 7.0.13, 7.1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory