HIGH Introduced in 6.3
ivpu BufferAddr OOB
CVE-2026-97917
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr Add a size parameter to ivpu_to_cpu_addr() and validate that the whole [vpu_addr, vpu_addr + size) range stays within the BO.
02KernelScan AI Analysis
Risk summary
A local user with access to an Intel VPU accelerator device can trigger out-of-bounds memory reads and writes in the kernel by supplying VPU addresses that pass a start-only bounds check but extend beyond the buffer object. This can lead to kernel memory corruption, information disclosure, or denial of service via kernel panic.
Vulnerability analysis
The Intel VPU accelerator driver's address-translation helper only validated that the start of a VPU-side address fell within a buffer object, not that the entire structure-sized access range stayed in bounds. When a VPU address pointed near the end of a buffer, the driver would read or write past the buffer's end, corrupting or leaking adjacent kernel memory. The fix adds a size parameter to the translation function and verifies that the full range fits within the buffer before returning a CPU pointer. The vulnerable code is reached through the VPU IPC subsystem, triggered locally by userspace submitting work to the VPU device or by processing IPC responses from VPU hardware; it requires the Intel VPU accelerator to be present and the driver loaded, with device access typically granted to non-root users in the render group.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.3 | 6.12.111 | 5419be345f32 |
| 6.18 | 6.3 | 6.18.53 | 43c68f52aecd |
| 6.6 | 6.3 | 6.6.160 | 962e565f45db |
| 7.2 | 6.3 | 7.2.7 | 29f82a2280e1 |
| mainline | 6.3 | 7.3 | 3837c3f29fbc |
| cip/6.12 | 6.3 | 6.12.111-cip32 | 5419be345f32 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |