CVE-2026-53202 Details
Description
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Change min_t(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast.
A signed integer truncation vulnerability has been identified in the Linux kernel's accel/ivpu driver, specifically in the IPC receive function. This issue can lead to a potential buffer overflow. The vulnerability arises because firmware-supplied data sizes are incorrectly cast to signed integers before being processed, allowing large unsigned values to become negative. This negative value can cause an unsigned wraparound, resulting in oversized memory copy operations that overflow the stack buffer. The vulnerability affects Linux kernel versions through 6.12.
Users can upgrade to Linux kernel versions 6.12.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:54343 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:54443 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-53202 | redhat-SADP | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492823 | redhat-SADP | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53202.json | redhat-SADP | Third Party Advisory |
| https://git.kernel.org/stable/c/2821bf2b79e47f87e1dbdd9d25c78240965a97d6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/45cb105b8642c65e9be286f7058e92314efe7ea3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4788556d4dd9d717037e385de178974e9649231d | kernel.org | Patch |
| https://git.kernel.org/stable/c/d9faef564438d1e4579c692c046603e7ada7bdf4 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-787 | Out-of-bounds Write | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.8, < 6.12.94 >= 6.13, < 6.18.36 >= 6.19, < 7.0.13 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 7.1 rc6 7.1 rc7 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 21, 2026 | CVE Modified | redhat-SADP |
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 25, 2026 | New CVE Received | kernel.org |