CVE-2026-97915
Received Received - Intake

Buffer Overflow in Linux Kernel accel/ivpu Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vpu_tracing_buffer_header is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces this, so printing it with an unbounded string conversion would read past the field if the terminator is ever missing and expose adjacent bytes of the shared tracing BO through dmesg and the debugfs FW log output. Print at most as many characters as the name field holds, so the output never runs past it even if the string is not NUL-terminated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97915
EUVD
EUVD-2026-86769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the firmware log handling for NPU (Neural Processing Unit) devices. The issue occurs because the firmware name in a tracing buffer header is a fixed-size array that may not be properly NUL-terminated. When printed, this could cause the system to read beyond the array's bounds, exposing adjacent memory in debug logs.

Detection Guidance

This vulnerability is specific to the Linux kernel's accel/ivpu driver and involves improper handling of firmware log names. Detection requires checking kernel logs for unexpected output from the VPU tracing buffer. Look for dmesg entries or debugfs FW log output containing untrusted strings from the firmware.

Impact Analysis

This vulnerability could allow exposure of sensitive kernel memory through debug logs. An attacker with access to system logs might gain information about adjacent memory contents, potentially aiding further exploits. It primarily affects systems using NPU devices with vulnerable firmware.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a potential information exposure in Linux kernel debug output, but no evidence suggests it leads to unauthorized data access or processing violations under these regulations.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. If immediate patching is not possible, monitor kernel logs for suspicious output and restrict access to debugfs to limit exposure. Disable NPU firmware logging if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart