Linux Kernel EUVD-2026-39296

Vendor-released patch: update to a fixed stable kernel - 6.12.94 or later in the 6.12 series, 6.18.36 or later, or 7.0.13 or later (the fix is also present in 7.1), corresponding to upstream commits 535da9ad8420, 5961c7034140, 8ec70c0dbdf0, and dd1311bcf0e6 available at git.kernel.org/stable. Apply your distribution's equivalent backported kernel package as soon as it ships and reboot to load the patched image. If immediate patching is not feasible on affected Intel NPU hardware, the most direct compensating control is to prevent the vulnerable code path from loading by blacklisting the intel_vpu/ivpu module (e.g. modprobe blacklist) where the NPU is unused - the trade-off is loss of all NPU acceleration for AI/ML workloads on that host. Restricting local access and removing untrusted users from systems exposing the accelerator device reduces who can reach the local attack surface, though it does not address compromised firmware as the input source.