CVE-2026-97916

Summary

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Validate firmware log buffer metadata

The tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared BOs that the NPU firmware can write to.

fw_log_from_bo() validated log->header_size and log->size, but fw_log_print_buffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs.

Snapshot the validated values once with READ_ONCE() and pass them down explicitly in a new struct ivpu_fw_log_desc instead of re-reading them from the shared struct.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxd4e4257afa6ed5205eda993180401fc2c20e4b60 < 8ec3d6972f1440fae6c8dadd1859892775208759affected
LinuxLinuxd4e4257afa6ed5205eda993180401fc2c20e4b60 < 40868f80a89199630b03d4457876f9a1feba0660affected
LinuxLinuxd4e4257afa6ed5205eda993180401fc2c20e4b60 < b1555f63ee1a680f280bc18e8dac416f250e2ec3affected
LinuxLinuxd4e4257afa6ed5205eda993180401fc2c20e4b60 < 0724afc55c77c36c7feb9a7264b02aa7593c5c2daffected
LinuxLinux6.6affected
LinuxLinux0 < 6.6unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc3 <= *unaffected

Weaknesses

References