Linux accel/ivpu: signed truncation of firmware data_size overflows a stack buffer on IPC receive

Impact

The ivpu accelerator driver casts a firmware-supplied data_size to signed int before min_t(), so any value at or above 0x80000000 goes negative, the bound wraps, and the following memcpy overruns a stack buffer in kernel context. That is local kernel code execution or a panic on the affected node. Scope matters here: ivpu drives Intel's on-package NPU found in Meteor Lake and later client and edge silicon, not the discrete accelerators in a typical NVIDIA or AMD training node, so most datacenter fleets never load the module. Where it is loaded, such as edge inference boxes or shared developer nodes, a local user holding the accel device node is in reach. Check your loaded module list before scheduling any maintenance for this one.

Who can reach it

Local user with access to the /dev/accel device node, or compromised NPU firmware supplying the oversized IPC length. No remote path, no privileged account beyond device access.

What to do

Move to a stable kernel carrying the fix, or apply Red Hat erratum RHSA-2026:54343 on RHEL 9/10. A kernel update means draining and rebooting each affected node. If ivpu is not in use on your hardware, blacklisting the module removes the exposure with no reboot.

References