In the Linux kernel, the firmware log printing routine re-reads metadata from shared memory after an initial check, allowing a time-of-check to time-of-use race. An attacker who can influence the firmware can alter the header size or total size between the two reads, causing the kernel to dereference memory outside the intended buffer when printing logs. This out-of-bounds read can expose arbitrary kernel memory contents, leading to information disclosure, or cause a kernel panic if the bad pointers lead to invalid accesses, thus presenting a potential denial of service. The vulnerability stems from improper validation of shared firmware log metadata and results in a classic TOCTOU flaw within a privileged component.

The flaw exists in the Linux kernel when the ivpu accelerator driver is active. All Linux distributions running a kernel that includes the ivpu module and NPU firmware capable of sending log messages are affected. No specific kernel version was listed, so any build that ships the vulnerable ivpu firmware handling code is potentially impacted.

The CVSS score is 5.5, and the EPSS score indicates a low likelihood of exploitation (< 1%). The vulnerability is not listed in the CISA KEV catalog. The attack vector requires a malicious or compromised NPU firmware that can modify the shared metadata between the initial check and the final read. As such, the risk remains moderate, but exploitation requires firmware-level tampering and is unlikely to be a generic remote exploitation vector.