CVE-2026-97916: accel/ivpu: Validate firmware log buffer metadata
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Validate firmware log buffer metadata
The tracing log headers parsed by fwlogprintbuffer() reside in DMA-shared BOs that the NPU firmware can write to.
fwlogfrombo() validated log->headersize and log->size, but fwlogprintbuffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs.
Snapshot the validated values once with READONCE() and pass them down explicitly in a new struct ivpufwlogdesc instead of re-reading them from the shared struct.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds access?
The issue requires NPU firmware to modify tracing log header metadata in DMA-shared buffer objects after the host validates the metadata but before it uses the fields again while printing logs. The affected path is firmware log parsing and printing.
What is the practical impact of the race?
A successful race can cause the host to dereference out-of-bounds addresses while printing firmware logs. The description does not state an impact beyond this out-of-bounds access.
How can I tell whether the fix is present?
The fix snapshots validated log header size and buffer size values with READ_ONCE() and passes them to the printing path in an ivpu_fw_log_desc structure, rather than re-reading those fields from the DMA-shared log header. The referenced stable commits can be used to verify whether this change is included.