CVE-2026-53172

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: fix IFM region index out-of-bounds in command stream parser

NPU_SET_IFM_REGION extracts the region index with param & 0x7f, giving

a maximum value of 127. However region_size[] and output_region[] in

struct ethosu_validated_cmdstream_info are both sized to

NPU_BASEP_REGION_MAX (8), giving valid indices [0..7].

Every other region assignment in the same switch uses param & 0x7:

NPU_SET_OFM_REGION: st.ofm.region = param & 0x7;

NPU_SET_IFM2_REGION: st.ifm2.region = param & 0x7;

NPU_SET_WEIGHT_REGION: st.weight[0].region = param & 0x7;

NPU_SET_SCALE_REGION: st.scale[0].region = param & 0x7;

The 0x7f mask on IFM is inconsistent and appears to be a typo.

feat_matrix_length() and calc_sizes() use the region index directly

as an array subscript into the kzalloc'd info struct:

info->region_size[fm->region] = max(...);

A userspace caller supplying NPU_SET_IFM_REGION with param > 7 causes

a write

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References