CVE-2026-53170

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the accel/ethosu component where DMA commands with uninitialized lengths are not properly rejected. The cmd state init() function initializes the command state using memset(0xff), which sets dma->len to U64 MAX to indicate a missing setup. If userspace fails to provide the NPU SET DMA0 LEN command and instead issues NPU OP DMA START, dma->len remains U64 MAX.

Within the dma length() function, adding a positive stride to U64 MAX causes an integer wrap-around to a small value. When size0 is 1, the check mul overflow() function is not triggered, and dma length() returns 0. This allows the subsequent U64 MAX check to pass, resulting in region size[] remaining 0 and bypassing the bounds check in ethosu job.c. Consequently, the hardware may execute DMA operations using stale physical addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.