{"apiVersion":"1.0","identifier":"CVE-2026-72089","description":"In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes: u32 data_size = log->size - log->header_size; which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 (-accel/ivpu: Add bounds checks for firmware log indices-), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header. Reject logs whose size is smaller than the header (which also rejects size == 0).","publishedAt":"2026-08-15T06:21:22","lastModifiedAt":"2026-08-17T06:18:07","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72089","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","epssProbability":0.00166,"riskScore":0.72,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72089","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72089","en":"https://www.redsauce.net/en/cves/CVE-2026-72089","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72089","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72089","de":"https://www.redsauce.net/de/cves/CVE-2026-72089","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72089","el":"https://www.redsauce.net/el/cves/CVE-2026-72089"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72089"}}