CVE-2026-53172: accel/ethosu: fix IFM region index out-of-bounds in command stream parser
In the Linux kernel, the following vulnerability has been resolved:
accel/ethosu: fix IFM region index out-of-bounds in command stream parser
NPUSETIFMREGION extracts the region index with param & 0x7f, giving a maximum value of 127. However regionsize[] and outputregion[] in struct ethosuvalidatedcmdstreaminfo are both sized to NPUBASEPREGIONMAX (8), giving valid indices [0..7].
Every other region assignment in the same switch uses param & 0x7: NPUSETOFMREGION: st.ofm.region = param & 0x7; NPUSETIFM2REGION: st.ifm2.region = param & 0x7; NPUSETWEIGHTREGION: st.weight[0].region = param & 0x7; NPUSETSCALEREGION: st.scale[0].region = param & 0x7;
The 0x7f mask on IFM is inconsistent and appears to be a typo.
featmatrixlength() and calcsizes() use the region index directly as an array subscript into the kzalloc'd info struct: info->regionsize[fm->region] = max(...);
A userspace caller supplying NPUSETIFMREGION with param > 7 causes a write up to 1278 = 1016 bytes past the start of regionsize[], corrupting adjacent kernel heap data.
Fix by applying the same & 0x7 mask used by all other region assignments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
accel/ethosuto a version that resolves this vulnerability.Patch fix IFM region index out-of-bounds in command stream parser - Configuration
Apply the same 0x7 mask to NPU_SET_IFM_REGION when extracting the IFM region index, so region index is computed as `st.ifm.region = param & 0x7` (consistent with NPU_SET_OFM_REGION / NPU_SET_SCALE_REGION / NPU_SET_WEIGHT_REGION using `param & 0x7`).
Linux kernel (accel/ethosu) command stream parser IFM region index extraction mask for NPU_SET_IFM_REGION = param & 0x7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53172?
The severity of CVE-2026-53172 is high with a score of 7.8.
What does CVE-2026-53172 affect?
CVE-2026-53172 affects the Linux kernel, specifically the accel/ethosu component.
How do I fix CVE-2026-53172?
To fix CVE-2026-53172, update the Linux kernel to a version that includes the patch for this vulnerability.
What kind of vulnerability is CVE-2026-53172?
CVE-2026-53172 is an out-of-bounds access vulnerability in the command stream parser of the Linux kernel.
What is the impact of CVE-2026-53172?
CVE-2026-53172 can lead to potential denial of service or arbitrary code execution due to the out-of-bounds access.