CVE-2026-53172

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write issue exists in the command stream parser of the Ethos-U NPU accelerator. The NPU SET IFM REGION operation incorrectly uses a 0x7f mask when extracting the region index, allowing values up to 127, while the region size[] and output region[] arrays in the ethosu validated cmdstream info structure are only sized for 8 elements (indices 0 to 7). When a userspace caller provides a parameter greater than 7, the feat matrix length() and calc sizes() functions use this index to write data beyond the allocated memory of the region size[] array, potentially corrupting adjacent kernel heap data by up to 1016 bytes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.