Linux Kernel CVE-2026-72089

The vulnerability resides in the accel/ivpu subsystem, which implements the Linux kernel driver for Intel's AI Visual Processing Unit hardware integrated into recent Intel SoCs. Firmware log buffers are processed from Buffer Objects (BOs) - kernel memory allocations mapped to the VPU firmware. The function fw_log_from_bo() was designed to validate header_size and that the log fits within the BO, but omitted the critical check that log->size >= log->header_size. In fw_log_print_buffer(), the expression 'u32 data_size = log->size - log->header_size' performs unsigned 32-bit arithmetic: when log->size < log->header_size, the result wraps to approximately 4,294,967,295 (U32_MAX - delta), completely defeating the log_start/log_end clamp logic added by commit dd1311bcf0e6. This causes fw_log_print_lines() to iterate over a near-maximum-size virtual region, reading kernel memory well past the actual BO allocation. A secondary defect - when log->size == 0, the offset advance is also 0 - causes callers to loop forever on the same malformed header, resulting in a hung kernel thread. While NVD lists CWE as N/A, this maps to CWE-191 (Integer Underflow) leading to CWE-125 (Out-of-Bounds Read) and CWE-835 (Infinite Loop).