CVE-2026-17051

Name of the Vulnerable Software and Affected Versions Intel SEDI IPM (affected versions not specified)

Description The Intel SEDI IPM driver contains an out-of-bounds write issue in the ipm event dispose() function within drivers/ipm/ipm sedi.c. The driver processes inbound message interrupts by reading a peer-written doorbell register and extracting the payload length using IPC HEADER GET LENGTH(). This length is passed to sedi ipc read msg() to copy data into struct ipm sedi context.incoming data buf without verifying if the length exceeds the buffer size. While the buffer is limited to 128 bytes, the doorbell length field can encode up to 1023 bytes.

Host-side software with driver-level or raw BAR access can manipulate the doorbell register to trigger an overflow of up to 895 bytes into static (.bss) memory. This occurs in an interrupt context and can corrupt the struct ipm sedi context, including the k sem and k mutex used by the transmit path, leading to kernel data-structure corruption and system crashes. The issue is exploitable when an application has registered an IPM receive callback via ipm register callback().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.