CVE-2026-97916

A moderate denial of service vulnerability was found in the Linux kernel's Intel NPU/VPU (ivpu) driver as shipped in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The firmware tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared buffer objects that the NPU device firmware can write to. The driver validates the log->header_size and log->size fields in fw_log_from_bo(), but fw_log_print_buffer() then re-reads those same fields from shared memory, creating a time-of-check to time-of-use (TOCTOU) race. A compromised NPU firmware can alter this metadata between the validation and its use, causing the host kernel to dereference out-of-bounds addresses while printing the log and crash the system. Exploitation requires the attacker to first compromise the NPU device firmware, and only availability is impacted; confidentiality and integrity are not affected. Red Hat Enterprise Linux 6, 7, 8, and 9, including the real-time (kernel-rt) variants, and the OpenShift Container Platform RHCOS layers are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams, the fix has been deferred and will be delivered in a future planned update rather than an immediate erratum. The residual risk of the deferral is limited to a local denial of service (kernel crash) on systems whose NPU firmware has already been compromised; no privilege escalation, data exposure, or integrity impact is established by the available evidence.