High 7.1Published Jun 25, 2026

CVE-2026-53205accel/ivpu: Add bounds checks for firmware log indices

Updated under an hour ago (Oct 27, 2026, 12:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds (< data_size) before using them. If out-of-bounds indices are encountered (from firmware), clamp them to safe values instead of proceeding with invalid offsets. This prevents potential out-of-bounds buffer access when firmware supplies invalid log indices.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0923a7d55a85179744926b7c11768a81679cc4d4 before 5961c703414048f46818be8bbb11075a9a63fb4e; from 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 before 8ec70c0dbdf04392a26e03e38798a373934177be; from 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 before 535da9ad8420c3b686a642403d4147ff220255fd; from 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 before dd1311bcf0e62f0c515115f46a3813370f4a4bb1; from 6.12.30 before 6.12.94	CNA record
linux linux_kernel linux:linux_kernel	from 6.12.30 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; 7.1; 7.1; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5961c703414048f46818be8bbb11075a9a63fb4e	patch
https://git.kernel.org/stable/c/8ec70c0dbdf04392a26e03e38798a373934177be	patch
https://git.kernel.org/stable/c/535da9ad8420c3b686a642403d4147ff220255fd	patch
https://git.kernel.org/stable/c/dd1311bcf0e62f0c515115f46a3813370f4a4bb1	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.