CVE-2026-53202
published 2026-06-25CVE-2026-53202: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
4.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix signed integer truncation in IPC receive
Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.
Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 3b434a3445fff3149128db0169da864d67057325 < 4788556d4dd9d717037e385de178974e9649231d | 4788556d4dd9d717037e385de178974e9649231d |
| linux | linux | >= 3b434a3445fff3149128db0169da864d67057325 < 45cb105b8642c65e9be286f7058e92314efe7ea3 | 45cb105b8642c65e9be286f7058e92314efe7ea3 |
| linux | linux | >= 3b434a3445fff3149128db0169da864d67057325 < 2821bf2b79e47f87e1dbdd9d25c78240965a97d6 | 2821bf2b79e47f87e1dbdd9d25c78240965a97d6 |
| linux | linux | >= 3b434a3445fff3149128db0169da864d67057325 < d9faef564438d1e4579c692c046603e7ada7bdf4 | d9faef564438d1e4579c692c046603e7ada7bdf4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.8 < 6.12.94 | 6.12.94 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.93/6.18.35/7.0.12 accel min_t buffer overflow (WID-SEC-2026-2077)
vuldb·2026-07-03·CVSS 7.8
CVE-2026-53202 [HIGH] Linux Kernel up to 6.12.93/6.18.35/7.0.12 accel min_t buffer overflow (WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 6.12.93/6.18.35/7.0.12. It has been declared as critical. This affects the function min_t of the component accel. The manipulation results in buffer overflow.
This vulnerability is reported as CVE-2026-53202. The attacker must have access to the local network to execute the attack. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast t
ghsa_unreviewed·2026-06-25
CVE-2026-53202 In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast t
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix signed integer truncation in IPC receive
Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.
Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.
Red Hat
kernel: accel/ivpu: Fix signed integer truncation in IPC receive
vendor_redhat·2026-06-25·CVSS 7.8
CVE-2026-53202 [HIGH] kernel: accel/ivpu: Fix signed integer truncation in IPC receive
kernel: accel/ivpu: Fix signed integer truncation in IPC receive
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix signed integer truncation in IPC receive
Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.
Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) -
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2821bf2b79e47f87e1dbdd9d25c78240965a97d6https://git.kernel.org/stable/c/45cb105b8642c65e9be286f7058e92314efe7ea3https://git.kernel.org/stable/c/4788556d4dd9d717037e385de178974e9649231dhttps://git.kernel.org/stable/c/d9faef564438d1e4579c692c046603e7ada7bdf4https://access.redhat.com/security/cve/CVE-2026-53202https://bugzilla.redhat.com/show_bug.cgi?id=2492823https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53202.json
2026-06-25
Published