The missing bounds check in the Linux kernel’s accel/ivpu subsystem allows a firmware image header to specify runtime memory that is not properly aligned or sized. This flaw can cause a memory allocation error or an out‑of‑bounds write during image transfer, leading to corruption of kernel memory. Depending on the context, an attacker could exploit this to gain elevated privileges or crash the system.

All Linux kernel releases prior to the commit that adds the bounds check are affected. The vulnerability is introduced in the accel/ivpu driver and is not tied to a specific distribution version, so any unpatched kernel may be vulnerable.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, which suggests that public exploitation is not currently widespread. However, the flaw involves a low‑level kernel memory operation that could allow privilege escalation if an attacker can supply a malicious IVPU firmware image. The likely attack vector is through the acceptance of a firmware image that bypasses size validation, and the required conditions include the ability to load firmware into the system’s firmwares subsystem.