Out-of-Bounds Write in Intel SEDI IPM Driver Affects Inter-Processor Communication

CVE-2026-17051

What is CVE-2026-17051?

The Intel SEDI IPM driver contains a vulnerability in its handling of inbound message interrupts, leading to potential out-of-bounds writes. Specifically, when the peer processor writes to the doorbell register, the driver reads the payload length without verifying it against the buffer size. This oversight allows for excessive data (up to 895 bytes) to be written into static memory, resulting in kernel data structure corruption and system instability. The affected functionality requires the registration of an IPM receive callback, which, in typical scenarios, could allow malicious entities to exploit this flaw by sending oversized messages. A patch has been introduced to restrict doorbell lengths exceeding IPC_DATA_LEN_MAX, enhancing the driver's security against such vulnerabilities.

References