GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53205 (GCVE-0-2026-53205)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
accel/ivpu: Add bounds checks for firmware log indices
Summary
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds (< data_size) before using them. If out-of-bounds indices are encountered (from firmware), clamp them to safe values instead of proceeding with invalid offsets. This prevents potential out-of-bounds buffer access when firmware supplies invalid log indices.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0923a7d55a85179744926b7c11768a81679cc4d4 , < 5961c703414048f46818be8bbb11075a9a63fb4e (git)
Affected: 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 , < 8ec70c0dbdf04392a26e03e38798a373934177be (git)
Affected: 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 , < 535da9ad8420c3b686a642403d4147ff220255fd (git)
Affected: 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 , < dd1311bcf0e62f0c515115f46a3813370f4a4bb1 (git)
Affected: 6.12.30 , < 6.12.94 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_fw_log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5961c703414048f46818be8bbb11075a9a63fb4e",
              "status": "affected",
              "version": "0923a7d55a85179744926b7c11768a81679cc4d4",
              "versionType": "git"
            },
            {
              "lessThan": "8ec70c0dbdf04392a26e03e38798a373934177be",
              "status": "affected",
              "version": "1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4",
              "versionType": "git"
            },
            {
              "lessThan": "535da9ad8420c3b686a642403d4147ff220255fd",
              "status": "affected",
              "version": "1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4",
              "versionType": "git"
            },
            {
              "lessThan": "dd1311bcf0e62f0c515115f46a3813370f4a4bb1",
              "status": "affected",
              "version": "1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.94",
              "status": "affected",
              "version": "6.12.30",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_fw_log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.12.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Add bounds checks for firmware log indices\n\nAdd validation that read and write indices in the firmware log buffer\nare within valid bounds (\u003c data_size) before using them. If\nout-of-bounds indices are encountered (from firmware), clamp them to\nsafe values instead of proceeding with invalid offsets.\n\nThis prevents potential out-of-bounds buffer access when firmware\nsupplies invalid log indices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local kernel interfaces for the Intel NPU/ivpu device, including debugfs log reads and recovery/coredump paths after local job submission. There is no network or adjacent-radio entry point.\nAC:L - No race or difficult timing is required once invalid firmware log indices are present; the log read/recovery path directly consumes them. A local attacker can repeatedly exercise the NPU and trigger log printing or recovery.\nPR:L - The relevant DRM accel ioctls do not require capabilities, and the debugfs fw_log file is created as readable when debugfs is accessible. This is reachable by a local low-privileged user with access to the NPU device/debug interface, not by an unauthenticated remote attacker.\nUI:N - Exploitation does not require a separate victim action. The attacker can invoke the local device/debugfs path directly.\nS:U - The impact is within the local kernel/device driver security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - Unbounded firmware-controlled indices can make the driver read far beyond the firmware log BO and print kernel memory through the log/coredump output path. This is an out-of-bounds read that can disclose high-value kernel memory.\nI:N - The vulnerable path reads bytes and prints them; it does not write out of bounds or provide an evident memory modification primitive. The fix only clamps read offsets.\nA:H - Out-of-bounds reads from a vmapped buffer can fault while walking unmapped memory or consume excessive resources while printing. This can cause a kernel oops/panic or serious denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:08.243Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5961c703414048f46818be8bbb11075a9a63fb4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ec70c0dbdf04392a26e03e38798a373934177be"
        },
        {
          "url": "https://git.kernel.org/stable/c/535da9ad8420c3b686a642403d4147ff220255fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd1311bcf0e62f0c515115f46a3813370f4a4bb1"
        }
      ],
      "title": "accel/ivpu: Add bounds checks for firmware log indices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53205",
    "datePublished": "2026-06-25T08:39:12.268Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:08.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53205",
      "date": "2026-09-15",
      "epss": "0.00166",
      "percentile": "0.0617"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53205\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:38.053\",\"lastModified\":\"2026-07-02T20:55:24.883\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naccel/ivpu: Add bounds checks for firmware log indices\\n\\nAdd validation that read and write indices in the firmware log buffer\\nare within valid bounds (\u003c data_size) before using them. If\\nout-of-bounds indices are encountered (from firmware), clamp them to\\nsafe values instead of proceeding with invalid offsets.\\n\\nThis prevents potential out-of-bounds buffer access when firmware\\nsupplies invalid log indices.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/accel/ivpu/ivpu_fw_log.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0923a7d55a85179744926b7c11768a81679cc4d4\",\"lessThan\":\"5961c703414048f46818be8bbb11075a9a63fb4e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4\",\"lessThan\":\"8ec70c0dbdf04392a26e03e38798a373934177be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4\",\"lessThan\":\"535da9ad8420c3b686a642403d4147ff220255fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4\",\"lessThan\":\"dd1311bcf0e62f0c515115f46a3813370f4a4bb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.30\",\"lessThan\":\"6.12.94\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/accel/ivpu/ivpu_fw_log.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.30\",\"versionEndExcluding\":\"6.12.94\",\"matchCriteriaId\":\"4255C966-4B23-4E8A-8127-1C6BFD53420C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.36\",\"matchCriteriaId\":\"389025D2-958D-41BD-BD96-70ED1033A9F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/535da9ad8420c3b686a642403d4147ff220255fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5961c703414048f46818be8bbb11075a9a63fb4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ec70c0dbdf04392a26e03e38798a373934177be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd1311bcf0e62f0c515115f46a3813370f4a4bb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:32:54+00:00",
      "cve": "CVE-2026-53205",
      "id": "CVE-2026-53205",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: accel/ivpu: Add bounds checks for firmware log indices",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53205.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T16:43:43Z",
      "cve": "CVE-2026-53205",
      "id": "CVE-2026-53205",
      "initial_release_date": "2026-06-26T02:10:08Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "385",
      "product_status:recommended": "201",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53205",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53205.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.