CVE-2026-68316

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached only through ioctls on the local Ethos-U DRM accel device node (/dev/accel/accelN) — DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE followed by ETHOSU_SUBMIT. There is no network or remote input path into the command stream validator.

AC:LAttack complexity, low

Every input to the flawed calculation (precision, depth, width, strides, base addresses, region) comes straight from the attacker's command stream, so the undercounted size check can be triggered deterministically on every attempt. No race, timing window, or uncontrollable memory layout is involved.

PR:LPrivileges required, low

Only an open file descriptor on the accel render node is needed; no capability, DRM_AUTH, or DRM_ROOT_ONLY flag guards any of the ethosu ioctls. On the Android/embedded systems where Ethos-U NPUs ship, this node is exposed to ordinary unprivileged inference applications.

UI:NUser interaction, none

The attacker performs the entire sequence itself — create a BO, create a crafted command-stream BO, submit the job. No victim action, file, or pre-existing state is required.

S:UScope, unchanged

The undersized validation lets the NPU DMA outside the buffer into other kernel-managed memory, but both the vulnerable driver and the corrupted resources belong to the same kernel security authority; no VM, IOMMU domain, or sandbox boundary is crossed.

C:HConfidentiality impact, high

Undercounting the input feature map extent makes the NPU DMA-read physical memory well past the end of the BO (hundreds of KB to megabytes, attacker-chosen via depth/width/strides), and the results are written into an output BO that userspace mmaps, giving a practical arbitrary kernel-memory disclosure primitive.

I:HIntegrity impact, high

The same undercount applies to the output feature map, so the NPU DMA-writes attacker-influenced computation results past the end of the buffer into adjacent kernel/CMA memory. This is a controlled out-of-bounds write performed by the device, bypassing CPU page protections and exploitable for privilege escalation.

A:HAvailability impact, high

Out-of-bounds DMA writes into arbitrary adjacent physical memory readily corrupt kernel data structures or other drivers' DMA buffers, producing oopses, panics, or platform-level aborts; on IOMMU-equipped platforms the stray access instead triggers a fatal translation fault.