Look up another CVE · open CVE-2026-53170 in the interactive tracker
CVE-2026-53170
accel/ethosu: reject DMA commands with uninitialized length
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem drivers/accel. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53170 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->len remains U64_MAX. In dma_length(), a positive stride added to U64_MAX wraps to a small value. With size0 == 1, check_mul_overflow() does not trigger and dma_length() returns 0 instead of U64_MAX. The caller's U64_MAX check then passes, region_size[] stays 0, and the bounds check in ethosu_job.c is bypassed, allowing hardware to execute DMA with stale physical addresses. Fix by checking for U64_MAX at the start of dma_length() before any arithmetic, consistent with the sentinel value used throughout the driver to detect uninitialized fields.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/accel/ethosu/ethosu_gem.c
- What this is
- ARM ETHOS-U NPU DRIVERMAINTAINERS section matched on drivers/accel/ethosu/ · dri-devel@lists.freedesktop.org · Supported
Check it on the machine
grep -wE 'CONFIG_DRM_ACCEL|CONFIG_DRM_ACCEL_ARM_ETHOSU' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_DRM_ACCEL, CONFIG_DRM_ACCEL_ARM_ETHOSU
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/accel
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.19 | 7.0.13 | fb25c76a820c |
| 6.19 | 7.1 | d9d021218162 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through local DRM accel device ioctls for Ethos-U command stream creation and job submission. There is no network, adjacent, or physical packet/device insertion path to this parser.
- AC:LAttack complexity, low
- The attacker controls the userspace command stream, can omit NPU_SET_DMA0_LEN, set the DMA mode/stride/size values needed for wraparound, and can prime stale base registers with prior jobs. No race or condition outside the attacker’s control is required.
- PR:LPrivileges required, low
- The Ethos-U ioctls are registered without DRM_ROOT_ONLY, DRM_AUTH, or DRM_MASTER checks, so no kernel capability or administrator privilege is required. Exploitation requires a local low-privileged user able to open the accel device node.
- UI:NUser interaction, none
- Once the local attacker can issue the ioctls, the command stream validation bypass and hardware job execution occur without any victim action. No user needs to open a file, mount anything, or approve the job.
- S:CScope, changed
- The bug lets a userspace client drive an external DMA-capable NPU using stale DMA addresses outside the per-job GEM/DMA isolation the driver is supposed to enforce. This is a DMA boundary bypass, so impact can extend beyond the vulnerable parser’s normal security authority.
- C:HConfidentiality impact, high
- A malicious DMA command can use a stale source base address and copy data from another or freed DMA mapping into attacker-controlled memory. In the highest reasonable embedded deployment, stale physical DMA access can expose sensitive kernel or cross-process memory.
- I:HIntegrity impact, high
- A malicious DMA command can use a stale destination base address and write attacker-controlled data outside the authorized GEM buffer. This can corrupt other DMA buffers or reused kernel memory and is defensibly an arbitrary memory modification primitive.
- A:HAvailability impact, high
- Invalid or malicious DMA can trigger NPU bus faults, scheduler resets, hangs, or broader kernel memory corruption. Repeated local submission can therefore cause high availability impact.