CVE-2026-97915

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97915", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.201Z", "datePublished": "2026-09-25T10:22:37.117Z", "dateUpdated": "2026-10-21T12:53:34.541Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:34.541Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Limit firmware log name prints to field size\n\nThe name in struct vpu_tracing_buffer_header is a fixed-size array\npopulated by the NPU firmware. It is expected to be NUL-terminated,\nbut nothing on the host side enforces this, so printing it with an\nunbounded string conversion would read past the field if the\nterminator is ever missing and expose adjacent bytes of the shared\ntracing BO through dmesg and the debugfs FW log output.\n\nPrint at most as many characters as the name field holds, so the output\nnever runs past it even if the string is not NUL-terminated."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/ivpu/ivpu_fw_log.c"], "versions": [{"version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "lessThan": "3d9365093f16b069908e610d17da172bf006bbde", "status": "affected", "versionType": "git"}, {"version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "lessThan": "6dbba89df4e842d226f5cd3dbc5e94533cfceea2", "status": "affected", "versionType": "git"}, {"version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "lessThan": "5d06257359c9006a208fece9eb7f0a0e83e0cc92", "status": "affected", "versionType": "git"}, {"version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "lessThan": "3d7130807009e9be6132c1394a2c7708a3ba39a7", "status": "affected", "versionType": "git"}, {"version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "lessThan": "95bf070f3225dc7175725438c916ad321d42fe45", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/accel/ivpu/ivpu_fw_log.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3d9365093f16b069908e610d17da172bf006bbde"}, {"url": "https://git.kernel.org/stable/c/6dbba89df4e842d226f5cd3dbc5e94533cfceea2"}, {"url": "https://git.kernel.org/stable/c/5d06257359c9006a208fece9eb7f0a0e83e0cc92"}, {"url": "https://git.kernel.org/stable/c/3d7130807009e9be6132c1394a2c7708a3ba39a7"}, {"url": "https://git.kernel.org/stable/c/95bf070f3225dc7175725438c916ad321d42fe45"}], "title": "accel/ivpu: Limit firmware log name prints to field size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/accel/ivpu/ivpu_fw_log.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3d9365093f16b069908e610d17da172bf006bbde", "status": "affected", "version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "versionType": "git"}, {"lessThan": "6dbba89df4e842d226f5cd3dbc5e94533cfceea2", "status": "affected", "version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "versionType": "git"}, {"lessThan": "5d06257359c9006a208fece9eb7f0a0e83e0cc92", "status": "affected", "version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "versionType": "git"}, {"lessThan": "3d7130807009e9be6132c1394a2c7708a3ba39a7", "status": "affected", "version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "versionType": "git"}, {"lessThan": "95bf070f3225dc7175725438c916ad321d42fe45", "status": "affected", "version": "d4e4257afa6ed5205eda993180401fc2c20e4b60", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/accel/ivpu/ivpu_fw_log.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Limit firmware log name prints to field size\n\nThe name in struct vpu_tracing_buffer_header is a fixed-size array\npopulated by the NPU firmware. It is expected to be NUL-terminated,\nbut nothing on the host side enforces this, so printing it with an\nunbounded string conversion would read past the field if the\nterminator is ever missing and expose adjacent bytes of the shared\ntracing BO through dmesg and the debugfs FW log output.\n\nPrint at most as many characters as the name field holds, so the output\nnever runs past it even if the string is not NUL-terminated."}], "id": "CVE-2026-97915", "lastModified": "2026-10-21T13:21:15.673", "metrics": {}, "published": "2026-09-25T11:17:18.487", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d7130807009e9be6132c1394a2c7708a3ba39a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d9365093f16b069908e610d17da172bf006bbde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d06257359c9006a208fece9eb7f0a0e83e0cc92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6dbba89df4e842d226f5cd3dbc5e94533cfceea2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/95bf070f3225dc7175725438c916ad321d42fe45"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: accel/ivpu: Limit firmware log name prints to field size", "id": "2541199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541199"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\naccel/ivpu: Limit firmware log name prints to field size\nThe name in struct vpu_tracing_buffer_header is a fixed-size array\npopulated by the NPU firmware. It is expected to be NUL-terminated,\nbut nothing on the host side enforces this, so printing it with an\nunbounded string conversion would read past the field if the\nterminator is ever missing and expose adjacent bytes of the shared\ntracing BO through dmesg and the debugfs FW log output.\nPrint at most as many characters as the name field holds, so the output\nnever runs past it even if the string is not NUL-terminated.", "A flaw was found in the Linux kernel's Intel Versatile Processing Unit (accel/ivpu) driver. The driver fails to verify that firmware-supplied log names are null-terminated before printing them. This issue causes an out-of-bounds memory read that can leak adjacent data from shared memory buffers into kernel logs and debugging interfaces. A local user with access to system logs could exploit this vulnerability to view sensitive memory contents, resulting in information disclosure."], "name": "CVE-2026-97915", "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97915\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97915\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97915.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4e4257afa6ed5205eda993180401fc2c20e4b60,6dbba89df4e842d226f5cd3dbc5e94533cfceea2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4e4257afa6ed5205eda993180401fc2c20e4b60,5d06257359c9006a208fece9eb7f0a0e83e0cc92)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4e4257afa6ed5205eda993180401fc2c20e4b60,3d7130807009e9be6132c1394a2c7708a3ba39a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d4e4257afa6ed5205eda993180401fc2c20e4b60,95bf070f3225dc7175725438c916ad321d42fe45)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:45:17.138625+00:00", "updated": "2026-10-01T07:00:03.041532+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}