Executive brief
A vulnerability was identified in the Linux kernel's driver for Arm Ethos-U NPUs, which are specialized processors used for artificial intelligence tasks. Errors in how the driver calculates memory usage could allow a malicious program to bypass security checks that prevent unauthorized access to system memory. This could potentially lead to system instability or unauthorized access to sensitive data.
Technical details
Multiple arithmetic issues were identified in the dma_length() function within drivers/accel/ethosu/ethosu_gem.c. Specifically, the function failed to account for potential integer underflows when handling signed stride values and overflows during intermediate multiplications and offset additions. Because the resulting region_size is used to validate command stream accesses against GEM buffer sizes, an attacker could trigger an arithmetic wraparound to under-report memory usage. This bypasses bounds validation, potentially allowing out-of-bounds memory access. The fix introduces overflow helpers and validates signed additions to ensure accurate memory region reporting.
Affected products
- Linux Linux Kernel 6.19, 7.0.13, 7.1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory