CVE-2026-53171

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: fix arithmetic issues in dma_length()

dma_length() derives DMA region usage from command stream values and

updates region_size[]:

len = ((len + stride[0]) * size0 + stride[1]) * size1

region_size[region] = max(..., len + dma->offset)

Several arithmetic issues can corrupt the derived region size:

- signed stride values may underflow when added to len

- intermediate multiplications may overflow

- len + dma->offset may overflow during region_size updates

- dma_length() error returns were not validated by the caller

region_size[] is later used by ethosu_job.c to validate command stream

accesses against GEM buffer sizes. Arithmetic wraparound can therefore

under-report region usage and bypass the bounds validation.

Fix by validating signed additions, using overflow helpers for

multiplications and offset updates, and propagating dma_length()

failures to the caller.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References