# CVE-2026-53170: accel/ethosu: reject DMA commands with uninitialized length

> An integer overflow in the Ethos-U NPU driver allows bypassing bounds checks, potentially enabling arbitrary memory access or code execution via DMA.

- **Severity:** High 8.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Jun 2026
- **Updated:** 5 Aug 2026
- **Also known as:** DEBIAN-CVE-2026-53170, GHSA-8pg6-rv6x-wjc2, UBUNTU-CVE-2026-53170

## What is CVE-2026-53170?

CVE-2026-53170 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: reject DMA commands with uninitialized length

cmd_state_init() initializes the command state with memset(0xff),
leaving dma->len at U64_MAX to signal missing setup. The only setter
is NPU_SET_DMA0_LEN; if userspace omits this command and issues
NPU_OP_DMA_START, dma->len remains U64_MAX.

In dma_length(), a positive stride added to U64_MAX wraps to a small
value. With size0 == 1, check_mul_overflow() does not trigger and
dma_length() returns 0 instead of U64_MAX. The caller's U64_MAX check
then passes, region_size[] stays 0, and the bounds check in
ethosu_job.c is bypassed, allowing hardware to execute DMA with stale
physical addresses.

Fix by checking for U64_MAX at the start of dma_length() before any
arithmetic, consistent with the sentinel value used throughout the
driver to detect uninitialized fields.

Weakness: CWE-908 (Use of Uninitialized Resource)

## Which versions are affected by CVE-2026-53170?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-53170?

Apply the vendor's patch.

## Is CVE-2026-53170 being exploited?

There is no known exploitation of CVE-2026-53170 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-53170 and fix it if it is affected.

What it is: CVE-2026-53170 is a high-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-53170 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-53170/ (Markdown: https://insights.sbomify.com/CVE-2026-53170/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-53170
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53170
- OSV: https://osv.dev/vulnerability/CVE-2026-53170

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-53170/
Summaries are generated and may contain mistakes; the official description above is the record.