CVE-2026-53202: accel/ivpu: Fix signed integer truncation in IPC receive
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix signed integer truncation in IPC receive
Fix potential buffer overflow where firmware-supplied datasize is cast to signed int before being used in mint(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer.
Change mint(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the accel/ivpu code so min_t(int, ...) is changed to min() since both values are unsigned and can become negative (>= 0x80000000) causing unsigned wraparound; and handle oversized memcpy operations by avoiding casts to signed int before being used in min_t().
Linux kernel (accel/ivpu) min_t(int, ...) replaced with min() = Use min() for unsigned values instead of min_t(int, ...) to avoid signed integer truncation - Configuration
Fix the potential buffer overflow by preventing firmware-supplied data_size from being cast to a signed int before being used (so oversized memcpy operations cannot overflow the stack buffer).
Linux kernel (accel/ivpu) firmware-supplied data_size casting = Avoid casting firmware-supplied data_size to a smaller signed int before it is used to compute/cap memcpy length
Event History
Frequently Asked Questions
What level of access and control does an attacker need?
Exploitation requires local access and low privileges, according to the CVSS vector. The vulnerable input is firmware-supplied IPC data_size, so an attacker would need a way to cause the driver to process a maliciously large firmware-provided value.
How can I determine whether my kernel contains the vulnerable code?
Affected systems can be identified by reviewing the accel/ivpu IPC receive implementation for data_size being cast to signed int and passed to min_t(int, ...). The corrected code uses min() with unsigned values, preventing values at or above 0x80000000 from becoming negative.