CVE-2026-98143: accel: ethosu: Don't read the U65 rounding mode as a storage mode

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

accel: ethosu: Don't read the U65 rounding mode as a storage mode

Bits 15:14 of NPUSET{IFM,OFM}PRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser has read it as a storage mode since the driver was added.

That went unnoticed while unknown values fell through the switch, but now that they are rejected, every U65 command stream that asks for natural rounding (2) fails CMDSTREAMBOCREATE with -EINVAL. Mesa emits it for average pooling, concatenation, split, unpack, strided slice, LUT and argmax, which is 72 failures of the Teflon test suite on an i.MX93. Truncating rounding (1) is misread as well: it picks the two-tile address path and computes a bogus feature map size from tile bases the command stream never set.

Read the field as a storage mode only on the hardware where it is one.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:36 AM
Data Sourced
via MITRE·10:36 AM
Description

Frequently Asked Questions

1

Which systems are affected by this issue?

The issue affects Linux systems using the Ethos-U driver with U65 hardware. The precision-field interpretation differs on U85, where those bits do select activation storage mode.

2

What workload behavior can reveal that a U65 system is affected?

U65 command streams requesting natural rounding can fail CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits natural rounding for average pooling, concatenation, split, unpack, strided slice, LUT, and argmax operations.

3

What happens when truncating rounding is used on U65?

Truncating rounding is also misread as a storage mode. It can select a two-tile address path and calculate an invalid feature-map size from tile-base values that the command stream did not set.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203