The Linux kernel’s accel/ivpu firmware log parser fails to verify that a firmware report’s declared size is at least as large as its header. When the size is smaller, the subtraction that calculates the data payload underflows and produces an almost maximal unsigned 32‑bit value. The subsequent print routine uses this inflated data size to read far beyond the intended buffer, potentially exposing kernel memory contents. A size of zero also causes the parser to loop indefinitely on the same header, which can lead to a denial of service.

All Linux kernel builds that include the accel/ivpu subsystem before the patch that introduces undersized‑log rejection are affected. The public CPE string indicates the vulnerability is present across all kernel releases containing the vulnerable code path, and the advisory does not list specific versions, so any kernel revision prior to the fix remains at risk until updated.

The CVSS score of 7.1 signifies a moderate to high severity vulnerability. The EPSS score of less than 1% indicates that self‑served exploitation is unlikely at present, and the issue is not included in CISA’s KEV catalog. Exploitation would likely require an attacker to supply or manipulate a firmware log that reports an undersized or zero size, a capability that would normally be restricted to the firmware interface or trusted components, but which could be abused if firmware updates or mis‑configured hardware inject such logs. Attackers could therefore retrieve sensitive kernel data or cause a service interruption by triggering the infinite loop.