CVE-2026-97916

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Validate firmware log buffer metadata

The tracing log headers parsed by fw log print buffer() reside in DMA-shared BOs that the NPU firmware can write to.

fw log from bo() validated log->header size and log->size, but fw log print buffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs.

Snapshot the validated values once with READ ONCE() and pass them down explicitly in a new struct ivpu fw log desc instead of re-reading them from the shared struct.