CVE-2026-97917

Executive Summary

CVE-2026-97917 is a Linux kernel vulnerability in the accel/ivpu driver (Intel VPU/NPU accelerator subsystem). The address-translation helper ivpu_to_cpu_addr() validated only a single address, not the entire [vpu_addr, vpu_addr + size) buffer range, allowing a caller-supplied size to extend past the bounds of the underlying buffer object (BO). The fix adds a size parameter and performs full-range validation. Impact is local-only: a local user able to reach the ivpu driver's ioctl/mmap surface may trigger out-of-bounds memory access, with potential information disclosure or memory corruption. No public PoC, exploit, or CISA KEV entry currently exists.

Technical Analysis

The Linux kernel's accel/ivpu driver implements support for Intel's Versatile Processing Unit (VPU), a data-center inference accelerator exposed to userspace through a character-device and ioctl interface. Userspace and in-kernel components frequently need to translate a guest/VPU-side virtual address (vpu_addr) into a CPU-accessible kernel address. This translation is performed by the helper function ivpu_to_cpu_addr().

The root cause described in the NVD entry is a range-validation defect: the original ivpu_to_cpu_addr() accepted only a vpu_addr and validated that single address. It did not validate a length. A caller that then accessed size bytes starting at the returned CPU address (for example during a DMA copy, mmap fault handling, or command-buffer read) could walk past the end of the mapped buffer object (BO). Because the validation checked only the start pointer, an address near the end of a BO would pass the check while start + size would land outside the allocation — a classic out-of-bounds access.

The fix is structural and explicit: a size parameter is added to ivpu_to_cpu_addr(), and the function now validates that the entire [vpu_addr, vpu_addr + size) range stays within the BO. This converts an incomplete boundary check into a full-range bounds check, eliminating the off-the-end case and (by construction) guarding against size values that would otherwise overflow the validated window.

Vulnerability class: improper validation of a specified quantity/length against the true bounds of a resource — an out-of-bounds read/write precondition caused by validating a start address but not the extent. The flaw is in how the driver maps VPU addresses to CPU addresses, so it is reachable from any code path that supplies an untrusted length alongside a VPU-side address. No function names, parameters, ioctl numbers, or file paths beyond ivpu_to_cpu_addr() and the vpu_addr/size parameter names are provided in the source data, so the precise callers cannot be enumerated here without fabrication.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-97917; the attack chain below is inferred strictly from the vulnerability class (out-of-bounds access via unvalidated buffer length) and the accel/ivpu driver context. Specific ioctl numbers, structure layouts, and call paths are not derivable from the provided data and are deliberately not invented.

1. Reconnaissance / target identification. The attacker first determines whether the target host exposes the Intel VPU/NPU accelerator and loads the accel/ivpu driver — i.e., a system with Intel VPU hardware and the corresponding kernel module present. Detection is local: probing device nodes, driver presence, and kernel version/module list. There is no network-facing service, so Shodan/Internet scanning is not applicable; the "reconnaissance" step is local privilege and capability assessment by an already-present user (e.g., a low-privileged account or a compromised unprivileged process).

2. Triggering the flaw class. The attacker leverages a driver entry point that ultimately calls ivpu_to_cpu_addr() with an attacker-influenced vpu_addr and an attacker-chosen size. Because only the starting address was validated pre-fix, the attacker positions vpu_addr at or near the end of a valid BO and selects a size that extends beyond the BO boundary. The single-address check passes, and subsequent access to the returned CPU address over size bytes reads or writes memory outside the intended allocation.

3. Payload / execution method (class level). At the vulnerability-class level, the outcome of supplying a too-large size for a validated start address is an out-of-bounds memory read and/or write in kernel context. Depending on how the translated range is consumed, this manifests as disclosure of adjacent kernel memory (information leak that can defeat KASLR) or as corruption of memory beyond the BO. No specific memory-copy routine or primitive is specified in the source data.

4. Post-exploitation impact. In a worst case, kernel-context out-of-bounds access can be escalated: an information leak aids further exploitation and a controlled out-of-bounds write can corrupt adjacent kernel structures, potentially yielding local privilege escalation or kernel denial of service (crash). Because the vulnerable code is only reachable through the local accelerator driver interface, the realistic attacker model is a local unprivileged user, not a remote adversary — no remote attack surface is described.

Impact Assessment

CVE-2026-97917 is a local, kernel-level vulnerability. The affected component is the Linux kernel accel/ivpu driver for Intel VPU/NPU accelerators. Systems without Intel VPU hardware, or without the accel/ivpu module loaded, are not exposed through this driver. Blast radius is therefore limited to Linux hosts with the relevant accelerator hardware and driver — a narrow slice of enterprise fleets, typically AI/inference and edge compute nodes rather than general-purpose servers or endpoints.

Impact class: out-of-bounds memory access in kernel context, yielding potential loss of confidentiality (kernel memory disclosure) and/or integrity (memory corruption), with availability impact including possible kernel panic if a corrupted or invalid range is dereferenced. These map to C:H/I:H/A:H.

CVSS caveat: NVD has published no CVSS score or vector (CVSS = N/A in the source data). The vector shown in METADATA is an analyst estimate based solely on the local attack vector, the out-of-bounds class, and the elevated privileges required to reach the driver; it is not an authoritative score and should not be presented as an NVD rating. No EPSS value is available (not yet scored by FIRST.org) and none is fabricated here. CISA KEV status: not listed.

Business impact is concentrated on AI/accelerated-compute infrastructure. On multi-tenant or shared-accelerator hosts, a local user or container with access to the VPU device could attempt to break isolation via a kernel memory flaw, which is relevant to container-escape and sandbox-escape threat models even though this specific CVE is local rather than remote.

Detection Guidance

Because this is a local kernel driver flaw with no network signature, detection focuses on host-level telemetry: abnormal device-node access, kernel memory errors, and module/version checks. The rules below are behavior-based and intentionally generic, since no specific ioctl numbers, paths, or bytes are provided; they detect the vulnerability class (unexpected boounds-range access to the ivpu device) and the patch state rather than a known-bad artifact.

Sigma Rule

title: Linux accel/ivpu Access With Potential Out-of-Bounds Buffer Range
id: 9f3c1d2a-9791-4c17-8a6e-ivpu0000979
status: experimental
description: Detects access to the Intel VPU (accel/ivpu) device by non-root processes and kernel OOB/bounds warnings that may indicate exploitation of CVE-2026-97917 (unvalidated buffer size in ivpu_to_cpu_addr).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97917
author: valtersit.com
logsource:
  product: linux
  service: auditd
detection:
  selection_device_open:
    type: 'SYSCALL'
    syscall: 'openat'
    name|endswith: '/ivpu'
  selection_nonroot:
    uid|ne: 0
  selection_kernel_bounds:
    type: 'KERNEL'
    key: 'ivpu'
  condition: (selection_device_open and selection_nonroot) or selection_kernel_bounds
falsepositives:
  - Legitimate local workloads (AI/inference processes) with delegated VPU device access
  - Normal driver probe/initialization touching the ivpu node as root
level: medium
tags:
  - attack.t1068
  - cve.2026.97917

YARA Rule

rule CVE_2026_97917_ivpu_range_validation_marker
{
    meta:
        author      = "valtersit.com"
        description = "Identifies kernel builds/messages referencing the ivpu_to_cpu_addr range-validation fix (CVE-2026-97917)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-97917"
        cve         = "CVE-2026-97917"
        date        = "2026-01-01"

    strings:
        $fn    = "ivpu_to_cpu_addr" ascii wide
        $drv   = "accel/ivpu" ascii wide
        $vpu   = "vpu_addr" ascii wide
        $bofix = "Validate full buffer range in ivpu_to_cpu_addr" ascii wide
        $vpu2  = "ivpu" ascii wide

    condition:
        uint32(0) == 0x464c457f or ( $fn and ( $drv or $bofix ) )
}

Suricata IDS Rule

No network-facing vulnerability exists; this CVE is not remotely triggerable and produces no on-wire signature. A Suricata rule can only serve as a low-value indicator of kernel memory-error/log text crossing a monitored stream, and is not a reliable exploit detector. Provided for completeness with a clearly bounded signature.

alert tcp any any -> any any (msg:"CVE-2026-97917 ivpu_to_cpu_addr range-validation flaw referenced in traffic/log"; flow:to_client,established; content:"CVE-2026-97917"; nocase; sid:9791701; rev:1; reference:cve,2026-97917; classtype:misc-activity; metadata:created_at 2026_01_01; )

Note: This signature only fires on explicit textual references, not on actual exploitation; treat as informational. The vulnerability is local and has no meaningful network detection surface.

Elastic Detection

sequence by host.id, process.pid
  [process where event.type == "start" and process.name != null and
     process.args : "*ivpu*"]
  [file where event.action == "opened" and file.path : "*/ivpu*" and
     process.thread.Ext or true]
| keep host.id, process.name, process.args, file.path, user.name

Interpretation: The rule correlates spawning a process that references the ivpu driver and subsequent opens of an ivpu device path by a non-service context. Tune the file.path and process.args globs to the exact device-node and utility names present in the environment, since those specifics are not provided in the source data.

Splunk SPL Query

index=os sourcetype=linux_audit OR sourcetype=syslog (kernel OR audit)
| rex field=_raw "(?<ivpu_ref>accel/ivpu|ivpu_to_cpu_addr|vpu_addr)"
| where isnotnull(ivpu_ref)
| eval user=coalesce(user,uid,auser)
| where user!="root" OR match(_raw,"(?i)(out[- ]?of[- ]?bounds|bounds|oops|BUG|general protection)")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, ivpu_ref
| sort - last_seen

This surfaces non-root interaction with the ivpu driver and any bounds/Ooops kernel messages, which are the practical host-side indicators of a range-validation bug being hit.

Wazuh OSSEC Rule

<group name="linux,kernel,ivpu,cve_2026_97917,">
  <rule id="979170" level="6">
    <decoded>yes</decoded>
    <match>ivpu_to_cpu_addr</match>
    <description>CVE-2026-97917: ivpu_to_cpu_addr range-validation anomaly referenced in kernel log</description>
    <group>cve_2026_97917,attack.t1068,</group>
  </rule>

  <rule id="979171" level="10">
    <if_sid>979170</if_sid>
    <match>out-of-bounds|bounds|oops|BUG|general protection</match>
    <description>CVE-2026-97917: potential out-of-bounds access in Intel VPU (accel/ivpu) driver</description>
    <group>cve_2026_97917,attack.t1068,</group>
  </rule>

  <rule id="979172" level="8">
    <decoded>yes</decoded>
    <match>accel/ivpu</match>
    <match>uid!=0</match>
    <description>CVE-2026-97917: non-root access to Intel VPU driver device node</description>
    <group>cve_2026_97917,attack.t1068,</group>
  </rule>
</group>

Decoders and field names (e.g., uid!=0 patterns) must be validated against the local Wazuh decoder set before deployment, as the underlying audit/device-node fields are environment-specific.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No affected/fixed version list, vendor advisory, or workaround is provided in the source data. The following are prudent, driver-scoped measures for operators of Intel VPU/NPU hosts; they are not a substitute for the upstream fix.

1. Immediate mitigations

• Restrict local access to the ivpu accelerator device node to trusted, root-owned or explicitly delegated services only. Local reachability is the precondition for exploitation, so removing device access from unprivileged users/containers removes the attack surface.
• In container environments, do not pass the VPU device node into untrusted or multi-tenant containers; enforce device cgroup and seccomp restrictions that prevent open/mmap/ioctl on the accelerator interface by non-essential workloads.
• Consider not loading the accel/ivpu module on systems where the accelerator is unused (modprobe -r ivpu / blacklist), which eliminates the vulnerable code path entirely.

2. Patch / upgrade steps

• Apply the upstream Linux kernel fix implementing full-range validation in ivpu_to_cpu_addr() (adds a size parameter and bounds-checks the whole [vpu_addr, vpu_addr + size) range). Since no fixed version is specified in the source data, verify the exact commit/version with the Linux kernel stable or distribution maintainers, then upgrade to a kernel that includes it.
• Reboot is required for a kernel update to take effect; confirm the new kernel is booted before considering the driver remediated.
• Track the distribution's backport status, as enterprises typically consume distro kernels rather than mainline.

3. Long-term hardening

• Apply least privilege to accelerator device access and keep strong device-level isolation between tenants on shared AI/edge hosts.
• Maintain a hardware/driver inventory so accelerator-driver CVEs can be quickly scoped to the minimal subset of hosts that actually load them.
• Monitor kernel logs for bounds/Ooops messages tied to accelerator drivers, and maintain a fast kernel patch cadence for any host exposing low-level device interfaces to non-privileged code.

References

• NVD — CVE-2026-97917: https://nvd.nist.gov/vuln/detail/CVE-2026-97917
• Linux kernel source / stable tree (accel/ivpu), upstream fix: "accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr" (commit reference not provided in source data; verify with kernel.org or the distro kernel maintainer)
• Intel VPU / accel driver documentation and Intel security advisories for the VPU/NPU accelerator subsystem
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-97917 is NOT listed)
• FIRST EPSS: https://www.first.org/epss (no score published as of this report)

Exploit-in-the-wild evidence: none. No public PoC, exploit code, Nuclei template, or known threat-actor campaign is associated with CVE-2026-97917 in the provided data, and CISA KEV does not list it.