- 7.1HighCVSS base score
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes: u32 data_size = log->size - log->header_size; which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu: Add bounds checks for firmware log indices"), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header. Reject logs whose size is smaller than the header (which also rejects size == 0).
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected d4e4257afa6ed5205eda993180401fc2c20e4b60 – < 5592a207e158b738d9c1d27f208dbbea13ae7606
- affected d4e4257afa6ed5205eda993180401fc2c20e4b60 – < dc9a1cda2e46d0254730a6f93cfe48532895f33c
- affected d4e4257afa6ed5205eda993180401fc2c20e4b60 – < 257321a1c036da417f5d9c47b95c7e58f62bf263
- affected d4e4257afa6ed5205eda993180401fc2c20e4b60 – < 6920e62be4c969a68ce4ebc59da68c6cbc9512e5
- affected d4e4257afa6ed5205eda993180401fc2c20e4b60 – < ddb44baed257560f192b145ed36cf8c0a412de47
- affected 6.6
- unaffected < 6.6
- unaffected 6.6.148 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References5
- https://git.kernel.org/stable/c/5592a207e158b738d9c1d27f208dbbea13ae7606 (opens in a new tab)
- https://git.kernel.org/stable/c/dc9a1cda2e46d0254730a6f93cfe48532895f33c (opens in a new tab)
- https://git.kernel.org/stable/c/257321a1c036da417f5d9c47b95c7e58f62bf263 (opens in a new tab)
- https://git.kernel.org/stable/c/6920e62be4c969a68ce4ebc59da68c6cbc9512e5 (opens in a new tab)
- https://git.kernel.org/stable/c/ddb44baed257560f192b145ed36cf8c0a412de47 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59047 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72089)Record last updated .