Answer in brief
CVE-2026-72089 records a Unknown severity vulnerability in accel/ivpu: Reject firmware log with size smaller than header. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <5592a207e158b738d9c1d27f208dbbea13ae7606 || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <dc9a1cda2e46d0254730a6f93cfe48532895f33c || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <257321a1c036da417f5d9c47b95c7e58f62bf263 || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <6920e62be4c969a68ce4ebc59da68c6cbc9512e5 || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <ddb44baed257560f192b145ed36cf8c0a412de47 | 5592a207e158b738d9c1d27f208dbbea13ae7606, dc9a1cda2e46d0254730a6f93cfe48532895f33c, 257321a1c036da417f5d9c47b95c7e58f62bf263, 6920e62be4c969a68ce4ebc59da68c6cbc9512e5, ddb44baed257560f192b145ed36cf8c0a412de47 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes: u32 data_size = log->size - log->header_size; which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu: Add bounds checks for firmware log indices"), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header. Reject logs whose size is smaller than the header (which also rejects size == 0).
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72089 records a Unknown severity vulnerability in accel/ivpu: Reject firmware log with size smaller than header. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <5592a207e158b738d9c1d27f208dbbea13ae7606 || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <dc9a1cda2e46d0254730a6f93cfe48532895f33c || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <257321a1c036da417f5d9c47b95c7e58f62bf263 || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <6920e62be4c969a68ce4ebc59da68c6cbc9512e5 || >=d4e4257afa6ed5205eda993180401fc2c20e4b60 <ddb44baed257560f192b145ed36cf8c0a412de47 | 5592a207e158b738d9c1d27f208dbbea13ae7606, dc9a1cda2e46d0254730a6f93cfe48532895f33c, 257321a1c036da417f5d9c47b95c7e58f62bf263, 6920e62be4c969a68ce4ebc59da68c6cbc9512e5, ddb44baed257560f192b145ed36cf8c0a412de47 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes: u32 data_size = log->size - log->header_size; which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu: Add bounds checks for firmware log indices"), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header. Reject logs whose size is smaller than the header (which also rejects size == 0).
Quoted source text, attributed separately from HOL analysis.