CVE-2026-97917

A flaw was found in the Linux kernel's Intel Versatile Processing Unit (ivpu) accelerator driver. A local user could trigger an out-of-bounds memory access by supplying an address range that extends beyond the allocated buffer object boundaries. This issue can lead to memory corruption or a system crash, resulting in a Denial of Service (DoS).

A Moderate-impact flaw was found in the Linux kernel's Intel Versatile Processing Unit (ivpu) accelerator driver shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 based nodes of OpenShift Container Platform. The ivpu_to_cpu_addr() function did not validate that the whole [vpu_addr, vpu_addr + size) range stays within the allocated buffer object (BO). A local user with access to the ivpu accelerator device could supply a VPU address range that extends beyond the allocated buffer object boundaries and trigger an out-of-bounds kernel memory access, resulting in memory corruption or a system crash, and therefore a denial of service. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges to the accelerator device and the primary consequence is loss of availability. RHEL 6, 7, and 8 kernel streams, the RHEL 8 and RHEL 9.2 real-time kernels, the RHEL 9.2 kernel stream, and OpenShift Container Platform versions before 4.16 are not affected because the vulnerable code is not present in those kernels. Because this is a moderate, local-only denial of service limited to systems where the affected ivpu accelerator hardware is present and accessible, the fix has been deferred to a future scheduled update of the affected streams; the residual risk is that such a local user could crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.