Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s ivpu accelerator driver can corrupt data when an already imported graphics buffer is exported again. A local, low-privileged user could potentially trigger incorrect device access without user interaction, affecting confidentiality, integrity, and availability. Network-based exploitation is not indicated.
Executive priority
Prioritize affected shared, multi-user, or untrusted-workload systems because exploitation requires local low-privileged access and could cause data exposure, modification, or disruption. Patch through normal emergency change controls after confirming vendor applicability; isolated systems without ivpu usage are lower priority.
Technical view
The ivpu GEM PRIME path allowed imported GEM objects to be re-exported. This loses buffer flag settings and may cause incorrect device access and data corruption. The kernel fix adds a custom handle-to-file-descriptor callback that rejects re-export of imported objects with EOPNOTSUPP.
Likely exposure
Exposure requires a Linux system using the affected ivpu driver and workflows that import then re-export GEM buffers. The record lists Linux 6.19, 7.0.7, and 7.1 as affected, but its version data is incomplete or ambiguous; confirm exact distribution kernel status with the vendor.
Exploitation context
CVSS 3.1 is 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The supplied record says KEV is false and provides no evidence of active exploitation or a public exploit.
Researcher notes
The security boundary failure is preservation of GEM buffer metadata across PRIME import and export. The fix blocks the unsafe transition rather than reconstructing lost flags. The supplied sources do not identify affected hardware models, attack prerequisites beyond CVSS, observed exploitation, or distribution-specific fixed package versions.
Mitigation direction
- Install a vendor kernel containing the applicable upstream stable fix.
- Confirm the selected kernel branch includes one of the referenced corrective commits.
- Until patched, restrict untrusted local access to systems exposing the ivpu device.
- Check distribution security guidance for backported fixes and precise affected versions.
Validation and detection
- Inventory systems loading or packaging the Linux ivpu driver.
- Record kernel and distribution package versions on potentially exposed systems.
- Verify the installed kernel contains the branch-appropriate referenced fix.
- Retest legitimate GEM import workflows and confirm imported objects cannot be re-exported.
- Monitor kernel and device logs for ivpu access errors or unexplained data corruption.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43498 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3756043dd695bba34cc728cdc5688dcb49ac8043CVE reference, Linux
- https://git.kernel.org/stable/c/7dd57d7a6350770dfc283287125c409e995200e0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.