CVE-2026-53170

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: reject DMA commands with uninitialized length

cmd_state_init() initializes the command state with memset(0xff),

leaving dma->len at U64_MAX to signal missing setup. The only setter

is NPU_SET_DMA0_LEN; if userspace omits this command and issues

NPU_OP_DMA_START, dma->len remains U64_MAX.

In dma_length(), a positive stride added to U64_MAX wraps to a small

value. With size0 == 1, check_mul_overflow() does not trigger and

dma_length() returns 0 instead of U64_MAX. The caller's U64_MAX check

then passes, region_size[] stays 0, and the bounds check in

ethosu_job.c is bypassed, allowing hardware to execute DMA with stale

physical addresses.

Fix by checking for U64_MAX at the start of dma_length() before any

arithmetic, consistent with the sentinel value used throughout the

driver to detect uninitialized fields.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References