CVE-2026-53170 accel/ethosu: reject DMA commands with uninitialized length
An integer overflow in the Ethos-U NPU driver allows bypassing bounds checks, potentially enabling arbitrary memory access or code execution via DMA.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53170?
CVE-2026-53170 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/ethosu: reject DMA commands with uninitialized length
cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->len remains U64_MAX.
In dma_length(), a positive stride added to U64_MAX wraps to a small value. With size0 == 1, check_mul_overflow() does not trigger and dma_length() returns 0 instead of U64_MAX. The caller's U64_MAX check then passes, region_size[] stays 0, and the bounds check in ethosu_job.c is bypassed, allowing hardware to execute DMA with stale physical addresses.
Fix by checking for U64_MAX at the start of dma_length() before any arithmetic, consistent with the sentinel value used throughout the driver to detect uninitialized fields.
Weakness: CWE-908
Which versions are affected by CVE-2026-53170?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53170?
Apply the vendor's patch.
Is CVE-2026-53170 being exploited?
There is no known exploitation of CVE-2026-53170 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-53170, GHSA-8pg6-rv6x-wjc2, UBUNTU-CVE-2026-53170.