The accel/ivpu driver in the Linux kernel contains a buffer overflow vulnerability in its get_info_ioctl handler. If the firmware reports an info size larger than the allocated buffer, the driver copies the data without verifying the bounds, leading to a kernel memory corruption that can be exploited to gain elevated privileges or crash the system. The flaw is a classic buffer overflow (CWE‑119).

All Linux kernel releases that shipped the accel/ivpu driver before the commit adding the overflow check are affected. Any distribution that has not yet incorporated this patch remains vulnerable until the kernel is updated to the latest commit where the overflow validation was introduced.

The vulnerability requires a local attacker who can invoke the ioctl on the accel/ivpu device, which is inferred from the nature of the vulnerability and the driver’s operation. No network‑based trigger is known. The absence of an EPSS score or KEV listing means the real‑world exploitation probability is uncertain, but the high severity of a kernel buffer overflow warrants caution. The patch prevents the unchecked copy and will mitigate the risk if applied.