CVE-2026-97915

A moderate information disclosure flaw was found in the Linux kernel's Intel Versatile Processing Unit (accel/ivpu) driver. The name field of struct vpu_tracing_buffer_header is a fixed-size array populated by the NPU firmware and is expected to be NUL-terminated, but the host driver does not enforce this before printing it. If the firmware omits the terminator, printing the name with an unbounded string conversion reads past the end of the field and can expose adjacent bytes of the shared tracing buffer object through the kernel log (dmesg) and the debugfs firmware log output. A local user with access to system logs or debugfs on a system with an affected Intel NPU could use this flaw to view sensitive memory contents.

The kernel packages in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected. Red Hat Enterprise Linux 6, 7, 8, and 9 (including the kernel-rt variant) and OpenShift Container Platform are not affected because the vulnerable code is not present in those products. Fixes for the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams are deferred to a future update; the residual risk is limited to local disclosure of bytes adjacent to the tracing buffer name field through kernel log and debugfs output.