CVE-2026-53173

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()

The command stream parsing loop increments the index variable a second

time when a 64-bit command word is encountered (bit 14 set), but does

not re-check the loop bound before writing the second word:

for (i = 0; i < size / 4; i++) {

bocmds[i] = cmds[0];

if (cmd & 0x4000) {

i++;

bocmds[i] = cmds[1]; /* unchecked */

}

}

The buffer bocmds is backed by a DMA allocation of exactly size bytes

from drm_gem_dma_create(ddev, size), giving valid indices [0, size/4-1].

When i == size/4 - 1 on entry to an iteration and bit 14 of cmds[0] is

set, bocmds[size/4-1] is written in bounds, i is then incremented to

size/4, and bocmds[size/4] writes four bytes past the end of the

allocation.

Userspace controls both the buffer contents and the size argument via

the ioctl, making this a userspace-triggerabl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References