In the Linux kernel, the following vulnerability has been resolved:
accel/ethosu: reject DMA commands with uninitialized length
cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->len remains U64_MAX.
In dma_length(), a positive stride added to U64_MAX wraps to a small value. With size0 == 1, check_mul_overflow() does not trigger and dma_length() returns 0 instead of U64_MAX. The caller's U64_MAX check then passes, region_size[] stays 0, and the bounds check in ethosu_job.c is bypassed, allowing hardware to execute DMA with stale physical addresses.
Fix by checking for U64_MAX at the start of dma_length() before any arithmetic, consistent with the sentinel value used throughout the driver to detect uninitialized fields.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-realtimeUpgrade linux-image-virtualUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-gkeUpgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-awsUpgrade linux-image-realtime-7.0Upgrade linux-image-azure-7.0Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-7.0.0-1014-azureUpgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-oracle-64kUpgrade linux-image-oem-26.04bUpgrade linux-image-aws-64k-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-realtime-64kUpgrade linux-image-raspi-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-7.0.0-31-genericUpgrade linux-image-aws-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-oracleUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-gcp-7.0Upgrade linux-image-virtual-7.0Upgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-gcpUpgrade linux-image-generic-7.0Upgrade linux-image-7.0.0-1013-oemUpgrade linux-image-aws-7.0Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-raspi-realtimeUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-oem-26.04Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-ibmUpgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-nvidiaUpgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1012-awsUpgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-nvidia-7.0Upgrade linux-image-gke-64k-7.0Upgrade linux-image-gke-64kUpgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-oem-26.04aUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-genericUpgrade linux-image-azure-lts-26.04Upgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-ibm-7.0Upgrade linux-image-nvidia-bos-7.0Upgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-raspiUpgrade linux-image-nvidia-bosUpgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-gke-7.0Upgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-oracle-7.0Upgrade linux-image-oem-7.0Upgrade linux-image-nvidia-64k | Sep 14, 2026 | Sep 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub