CVE-2026-72089

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Reject firmware log with size smaller than header

fwlogfrombo() validates the tracing buffer headersize and that the log fits within the BO, but never checks that log->size is at least log->headersize. fwlogprintbuffer() then computes:

u32 datasize = log->size - log->headersize;

which underflows to a near-U32MAX value when firmware reports a log whose size is smaller than its header. That huge datasize defeats the logstart/logend bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu: Add bounds checks for firmware log indices"), so fwlogprintlines() reads far past the small real data region of the BO. A size of 0 also makes fwlogfrombo() advance the offset by 0, causing the callers to loop forever on the same header.

Reject logs whose size is smaller than the header (which also rejects size == 0).