CVE-2026-97915 accel/ivpu: Limit firmware log name prints to field size
A missing NUL-termination check in the Linux kernel's Intel VPU driver allows local attackers to read adjacent memory via debug logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97915?
CVE-2026-97915 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Limit firmware log name prints to field size
The name in struct vpu_tracing_buffer_header is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces this, so printing it with an unbounded string conversion would read past the field if the terminator is ever missing and expose adjacent bytes of the shared tracing BO through dmesg and the debugfs FW log output.
Print at most as many characters as the name field holds, so the output never runs past it even if the string is not NUL-terminated.
Which versions are affected by CVE-2026-97915?
How do I fix CVE-2026-97915?
Apply the vendor's patch.
Is CVE-2026-97915 being exploited?
There is no known exploitation of CVE-2026-97915 in the wild and no public exploit code.
Sources
Also known as AZL-104256, BELL-CVE-2026-97915, DEBIAN-CVE-2026-97915, GHSA-qr56-qc89-442x, UBUNTU-CVE-2026-97915.