CVE-2026-40426

An integer underflow could interrupt Intel NPU processing on Linux

Intel · NPU driver for Linux

First documented disclosure · Review checkpoint

Summary

An integer underflow in the neural processing unit driver could stop local processing. Workloads using the neural accelerator could become unavailable.

Severity and exploitation evidence

Medium · 5.8/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An integer underflow in the neural processing unit driver could stop local processing.

Conditions required

Intel describes local authenticated access without user interaction.

Potential impact

Workloads using the neural accelerator could become unavailable.

Affected versions and configurations

Linux NPU driver before 1.33.0.

Fix and mitigation status

1.33.0 on Linux.

Practical next steps

Update the Intel Linux NPU driver to 1.33.0 or later.

Operating lesson

Check the installed component and distribution channel when matching a model workload to a driver or library fix.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources