CVE-2026-97912: accel: ethosu: Ensure SRAM size is 0 on mapping failure
In the Linux kernel, the following vulnerability has been resolved:
accel: ethosu: Ensure SRAM size is 0 on mapping failure
On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. The non-zero size allows jobs to access SRAM which is left pointing to physical base address 0x0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the SRAM size is set to 0 when SRAM mapping fails, preventing jobs from accessing SRAM left pointing to physical base address 0x0.
Event History
Frequently Asked Questions
Under what condition can the unsafe SRAM access occur?
It occurs when mapping the SRAM fails but probing still succeeds because SRAM is not a hard requirement. The failed mapping leaves the SRAM size non-zero, allowing jobs to treat SRAM as available.
What is the impact of the failed mapping state?
Jobs can access SRAM through a pointer left at physical base address 0x0. The fix ensures the SRAM size is set to zero when mapping fails, preventing jobs from using that unavailable mapping.