CVE-2026-68330

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix DMA direction for NPU mailbox buffer

airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,

but some callers expect the NPU to write response data back into the

same buffer:

- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into

the buffer, then the caller reads it via memcpy()

- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back

npu_stats_addr field in the response

On non-cache-coherent architectures like EN7581 (Cortex-A53 without

hardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op

— it does not invalidate the CPU cache. If the NPU-written cache line

is still present in the CPU cache when the caller reads the buffer,

the CPU observes stale data instead of the NPU response.

This is a timing-sensitive bug: small mailbox buffers (~24 bytes)

typically fit in a single cache line and may survive in the cache

until the caller reads them, produ

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References