The Linux kernel’s accel/ivpu firmware tracing buffer contains a fixed-size name field that is filled by firmware but is not guaranteed to be NUL-terminated. When the host code prints this field to dmesg or through debugfs without performing a length check, it can read past the intended buffer boundaries. The out‑of‑bounds read leaks adjacent bytes of the shared tracing buffer object, thereby exposing data that may contain confidential information. This flaw is a classic out‑of‑bounds read that presents a clear information‑leak weakness.

All builds of the Linux kernel that include the accel/ivpu firmware and its tracing buffer implementation are potentially affected. The vendor is Linux, and the affected product is the Linux kernel. Any distribution shipping a kernel version that has not been updated to implement the name‑length check is vulnerable.

The vulnerability can lead to an information‑leak via dmesg or the debugfs firmware log. The likely attack vector is local or privileged access to kernel debug interfaces; the description does not mention remote exploitation, so it is inferred that only users with kernel log or debugfs read permissions can exploit it. The EPSS score of <1% indicates a low probability of exploitation, and the CVSS score of 5.5 denotes moderate severity. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation. Nonetheless, because the exposure can reveal arbitrary kernel memory contents, the confidentiality impact can be significant in environments where debugging logs are accessible to non‑trusted users.