Skip to content
OpenAdvisories
High · 7.1 CVE-2026-53205 EUVD-2026-39296GHSA-gm9p-3w2c-c6qg

accel/ivpu: Add bounds checks for firmware log indices

Published Jun 25, 2026 · Updated Oct 19, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-7.0 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Add bounds checks for firmware log indices

Add validation that read and write indices in the firmware log buffer
are within valid bounds (< data_size) before using them. If
out-of-bounds indices are encountered (from firmware), clamp them to
safe values instead of proceeding with invalid offsets.

This prevents potential out-of-bounds buffer access when firmware
supplies invalid log indices.

Affected products

VendorProductAffectedFixed
Linux Linux 6.12.30 – < 6.12.94, 6.13 6.12.94

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.0.13-1 —
Debian 13 linux 6.12.94-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1032.37 —
Ubuntu 26.04 LTS linux 7.0.0-31.31 USN-8726-1
Ubuntu 26.04 LTS linux-aws 7.0.0-1012.12 USN-8726-1
Ubuntu 26.04 LTS linux-azure 7.0.0-1014.14 USN-8726-4
Ubuntu 26.04 LTS linux-gcp +1 7.0.0-1011.11 USN-8726-4, USN-8726-1
Ubuntu 26.04 LTS linux-gke 7.0.0-1006.7 USN-8726-1
Ubuntu 26.04 LTS linux-ibm +2 7.0.0-1013.13 USN-8727-1, USN-8726-3
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1018.18 USN-8760-2
Ubuntu 26.04 LTS linux-nvidia-bos 7.0.0-2018.18 USN-8800-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1019.19 USN-8726-2
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-31.31.1 USN-8726-1
Ubuntu 25.10 linux +8 No fix yet —
Ubuntu 24.04 LTS linux 6.8.0-146.146 USN-8903-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1066.69 USN-8903-1
Ubuntu 24.04 LTS linux-aws-7.0 7.0.0-1012.12~24.04.1 USN-8726-1
Ubuntu 24.04 LTS linux-azure-7.0 7.0.0-1014.14~24.04.1 USN-8728-2
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1068.75 USN-8904-1
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1013.13~24.04.1 —
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1070.78 USN-8905-2, USN-8904-1
Ubuntu 24.04 LTS linux-gcp-7.0 +1 7.0.0-1011.11~24.04.1 USN-8728-3, USN-8728-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1065.73 USN-8903-2
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1051.55 USN-8903-2
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-31.31~24.04.1 USN-8726-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1066.67 USN-8903-2
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-146.146.1 USN-8903-2
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1064.67 USN-8903-2
Ubuntu 24.04 LTS linux-nvidia-7.0 7.0.0-1018.18~24.04.1 USN-8760-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1064.67.1 USN-8903-2
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1036.39 USN-8886-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1063.66 USN-8903-2
Ubuntu 24.04 LTS linux-raspi 6.8.0-1068.72 USN-9025-1
Ubuntu 24.04 LTS linux-riscv +29 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-31.31.1~24.04.1 —
Ubuntu 24.04 LTS linux-vmware 6.8.0-1008.8 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1066.69~22.04.1 USN-8903-1
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1068.75~22.04.1 USN-8904-1
Ubuntu 22.04 LTS linux-gcp-6.8 +1 6.8.0-1070.78~22.04.1 USN-8905-1, USN-8904-1
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-149.149~22.04.1 USN-9066-1
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1066.67~22.04.1 USN-8906-1
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-146.146.1~22.04.1 USN-8903-2
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1064.67~22.04.1 USN-8903-2
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1067.71~22.04.1 USN-9025-1
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 6.8.0-146.146~22.04.1 —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2056.58 USN-9025-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1061.62 USN-8903-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1061.62~22.04.1 USN-8903-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1066.69+fips1 USN-8903-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-azure-fips 6.8.0-1069.77+fips1 USN-8904-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-146.146+fips1 USN-8903-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips 6.8.0-1070.78+fips1 USN-8905-1
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.37.1 SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_0 17-160000.4.3 SUSE-SU-2026:23341-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_1 15-160000.1.1 SUSE-SU-2026:23343-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_12 4-160000.1.1 SUSE-SU-2026:23330-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_13 4-160000.1.2 SUSE-SU-2026:23329-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_2 13-160000.1.1 SUSE-SU-2026:23340-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_3 12-160000.1.1 SUSE-SU-2026:23339-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_4 11-160000.1.1 SUSE-SU-2026:23338-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_5 10-160000.1.1 SUSE-SU-2026:23337-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_6 9-160000.1.1 SUSE-SU-2026:23336-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_7 8-160000.1.1 SUSE-SU-2026:23335-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_8 7-160000.1.1 SUSE-SU-2026:23334-1
SLES for SAP 16.0 kernel-livepatch-SLE16_Update_9 +2 6-160000.1.1 SUSE-SU-2026:23333-1, SUSE-SU-2026:23332-1, SUSE-SU-2026:23331-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.37.1 SUSE-SU-2026:23237-1, SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES 16.0 kernel-default-base 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23231-1, SUSE-SU-2026:23221-1
SLES 16.0 kernel-livepatch-SLE16_Update_0 17-160000.4.3 SUSE-SU-2026:23341-1
SLES 16.0 kernel-livepatch-SLE16_Update_1 15-160000.1.1 SUSE-SU-2026:23343-1
SLES 16.0 kernel-livepatch-SLE16_Update_12 4-160000.1.1 SUSE-SU-2026:23330-1
SLES 16.0 kernel-livepatch-SLE16_Update_13 4-160000.1.2 SUSE-SU-2026:23329-1
SLES 16.0 kernel-livepatch-SLE16_Update_2 13-160000.1.1 SUSE-SU-2026:23340-1
SLES 16.0 kernel-livepatch-SLE16_Update_3 12-160000.1.1 SUSE-SU-2026:23339-1
SLES 16.0 kernel-livepatch-SLE16_Update_4 11-160000.1.1 SUSE-SU-2026:23338-1
SLES 16.0 kernel-livepatch-SLE16_Update_5 10-160000.1.1 SUSE-SU-2026:23337-1
SLES 16.0 kernel-livepatch-SLE16_Update_6 9-160000.1.1 SUSE-SU-2026:23336-1
SLES 16.0 kernel-livepatch-SLE16_Update_7 8-160000.1.1 SUSE-SU-2026:23335-1
SLES 16.0 kernel-livepatch-SLE16_Update_8 7-160000.1.1 SUSE-SU-2026:23334-1
SLES 16.0 kernel-livepatch-SLE16_Update_9 +2 6-160000.1.1 SUSE-SU-2026:23333-1, SUSE-SU-2026:23332-1, SUSE-SU-2026:23331-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.37.1.160000.2.19 SUSE-SU-2026:23068-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_0 15-160000.3.4 SUSE-SU-2026:23272-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_1 14-160000.1.1 SUSE-SU-2026:23271-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_0 17-160000.4.3 SUSE-SU-2026:23293-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_1 15-160000.1.1 SUSE-SU-2026:23296-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_12 +2 4-160000.1.1 SUSE-SU-2026:23281-1, SUSE-SU-2026:23260-1, SUSE-SU-2026:23259-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_13 4-160000.1.2 SUSE-SU-2026:23280-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_2 13-160000.1.1 SUSE-SU-2026:23292-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_3 +1 12-160000.1.1 SUSE-SU-2026:23291-1, SUSE-SU-2026:23270-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_4 +2 11-160000.1.1 SUSE-SU-2026:23290-1, SUSE-SU-2026:23269-1, SUSE-SU-2026:23268-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_5 +1 10-160000.1.1 SUSE-SU-2026:23288-1, SUSE-SU-2026:23267-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_6 +1 9-160000.1.1 SUSE-SU-2026:23287-1, SUSE-SU-2026:23266-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_7 +1 8-160000.1.1 SUSE-SU-2026:23286-1, SUSE-SU-2026:23265-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_8 +1 7-160000.1.1 SUSE-SU-2026:23285-1, SUSE-SU-2026:23264-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_9 +5 6-160000.1.1 SUSE-SU-2026:23284-1, SUSE-SU-2026:23283-1, SUSE-SU-2026:23282-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.37.1 SUSE-SU-2026:23068-1, SUSE-SU-2026:23066-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.37.1.160000.2.19 openSUSE-SU-2026:21555-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.37.1 openSUSE-SU-2026:21555-1

Advisories 50

References