The accel/ivpu module in the Linux kernel contains a signed integer truncation flaw where a firmware supplied data_size value is cast to a signed int before being passed to min_t(); large unsigned values become negative and wrap around when min_t() computes an unsigned minimum. The resulting oversized memcpy triggers a stack buffer overflow, enabling corruption of kernel memory and potentially arbitrary code execution at ring‑0. This weakness is an example of Integer Overflow or Wraparound (CWE-190), leading to an Out‑of‑Bounds Write (CWE-787) and exposing a User‑Controlled Critical State (CWE-674).

Systems running the Linux 7.1 release candidate kernels (rc1 through rc7) that still expose the accel/ivpu IPC interface are vulnerable; any distribution using those kernels before the inclusion of commit 2821bf2b79e47f87e1dbdd9d25c78240965a97d6 is affected.

With a CVSS score of 7.8 the flaw is high severity, but the EPSS score is below 1% and it is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Based on the description, it is inferred that the attack vector requires local influence over the IVPU IPC interface, typically from signed firmware or trusted processes. If an attacker can supply a crafted data_size value, stack corruption may lead to privilege escalation or kernel execution.