Software in the Linux kernel within the accel/ivpu module contains a signed integer truncation bug in its IPC receive routine; a firmware‑supplied before being passed to min_t(), converting large unsigned values into negative numbers. The negative value causes unsigned wraparound in a subsequent min() operation, leading to an oversized memcpy that overflows a stack buffer. This flaw permits an attacker capable of controlling the data_size parameter to corrupt stack memory, potentially enabling arbitrary code execution or other kernel‑level damage.

Any Linux system running a kernel that includes the accel/ivpu IPC interface before the patch commit 2821bf2b79e47f87e1dbdd9d25c78240965a97d6. No specific kernel version numbers were supplied; therefore, all kernels containing the vulnerable accel/ivpu code are considered affected.

The vulnerability is a kernel‑level stack buffer overflow. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no known public exploits yet. Nonetheless, the high severity of a kernel overflow and the fact that the flaw requires only local influence on the IPC interface—typically accessible to firmware or trusted processes—make the risk significant. An attacker who can supply a crafted data_size value could corrupt kernel memory, leading to privilege escalation or arbitrary code execution.