Executive brief
A vulnerability in the Linux kernel's Arm Ethos-U NPU driver allows a local user to crash the system. By sending a specific unsupported command to the hardware accelerator, an attacker can trigger a kernel panic if the system is configured to halt on warnings. This results in a total loss of system availability, requiring a reboot to restore operations.
Technical details
A vulnerability exists in the 'accel/ethosu' driver within the Linux kernel due to the improper handling of the NPU_OP_RESIZE command. The driver contains a WARN_ON(1) macro in the ethosu_gem_cmdstream_copy_and_validate function that triggers whenever this unsupported command is submitted via the DRM_IOCTL_ETHOSU_GEM_CREATE ioctl. A local, unprivileged attacker with access to the DRM device can exploit this to cause unbounded kernel log spam or, if the 'panic_on_warn' kernel parameter is enabled, a full system crash (denial of service). The issue has been resolved by replacing the warning macro with an explicit -EINVAL error return to reject the command.
Affected products
- Linux Linux Kernel 6.19 to 7.0.13
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory