CVE-2026-68330

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the airoha npu send msg() function where the mailbox buffer is always mapped using DMA TO DEVICE. However, certain callers, such as airoha npu wlan msg get() (NPU OP GET) and airoha npu ppe stats setup() (NPU OP SET), expect the NPU to write response data back into the same buffer. On non-cache-coherent architectures, such as EN7581, the DMA TO DEVICE unmap operation does not invalidate the CPU cache. This can lead to the CPU reading stale data instead of the actual NPU response if the cache line is still present, resulting in silent data corruption. This timing-sensitive behavior occurs most frequently when the response is read immediately after dma unmap single() without intervening cache-evicting operations.

Recommendations Update the Linux kernel to a version where airoha npu send msg() uses DMA BIDIRECTIONAL for both map and unmap operations to ensure CPU cache invalidation on non-coherent systems.