The accel/ivpu driver in the Linux kernel contains a buffer overflow vulnerability in its get_info_ioctl handler. If the firmware reports an info size larger than the allocated buffer, the driver copies the data without verifying the bounds, leading to a kernel memory corruption that can be exploited to gain elevated privileges or crash the system. The flaw is a classic buffer overflow.

All Linux kernel releases that shipped the accel/ivpu driver before the commit adding the overflow check are affected. Any distribution that has not yet incorporated this patch remains vulnerable until the kernel is updated to the latest commit where the overflow validation was introduced.

The vulnerability requires a local attacker who can invoke the ioctl on the accel/ivpu device, which is inferred from the nature of the vulnerability and the driver’s operation. No network‑based trigger is known. The CVSS score of 7.1, the EPSS score of less than 1%, and the absence from the CISA KEV catalog indicate a moderate exploitation probability, but the kernel buffer overflow still poses a significant risk. The patch prevents the unchecked copy and will mitigate the risk if applied.