CVE-2026-97916

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Validate firmware log buffer metadata

The tracing log headers parsed by fw_log_print_buffer() reside in

DMA-shared BOs that the NPU firmware can write to.

fw_log_from_bo() validated log->header_size and log->size, but

fw_log_print_buffer() re-read those same fields from shared memory

afterwards, allowing a TOCTOU where firmware changes them between the

check and the use, and making the host dereference out-of-bounds

addresses while printing logs.

Snapshot the validated values once with READ_ONCE() and pass them down

explicitly in a new struct ivpu_fw_log_desc instead of re-reading them

from the shared struct.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References