CVE-2026-97917: accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Validate full buffer range in ivputocpuaddr
Add a size parameter to ivputocpuaddr() and validate that the whole [vpuaddr, vpuaddr + size) range stays within the BO.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update accel/ivpu function ivpu_to_cpu_addr() to accept a size parameter and validate that the full [vpu_addr, vpu_addr + size) range remains within the buffer object (BO).
Event History
Frequently Asked Questions
What condition is now checked when converting a VPU address to a CPU address?
The conversion validates that the entire requested range, from vpu_addr through vpu_addr + size, remains within the buffer object. Checking only the starting address is not sufficient.
How can I determine whether a kernel includes the fix?
Check whether the kernel contains a change that adds a size parameter to ivpu_to_cpu_addr() and validates the full requested buffer range. The provided stable references identify commits carrying this fix.