Executive brief
The Linux kernel's Arm Ethos-U NPU accelerator driver contains a memory management bug in its job submission code. When certain error conditions occur during job initialization, a fence object (a synchronization primitive) can be allocated but never properly freed, resulting in a memory leak. In cases involving scheduler initialization failures, the code may also attempt to release an uninitialized object, causing potential crashes.
Technical details
The vulnerability is a resource leak and uninitialized-object dereference in the accel/ethosu driver's job submission path. The function ethosu_ioctl_submit_job() allocates a done_fence object via kzalloc_obj() before validating buffer handles; if validation fails, ethosu_job_err_cleanup() is called but does not free the uninitialized fence, leading to a leak. Additionally, if dma_fence_init() fails in ethosu_job_run() due to a scheduler dependency error, the normal cleanup path (ethosu_job_cleanup()) attempts to call dma_fence_put() on a fence with a zeroed refcount, causing undefined behavior. The fix adds proper fence cleanup in the error handler using dma_fence_was_initialized() to distinguish initialized fences from raw allocations, and corrects a goto label to use the appropriate cleanup path.
Affected products
- Linux Linux kernel 5.5 and later (original ethosu driver introduction in 5.5+)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-08-26: patched: Fix committed upstream by Rob Herring
- 2026-09-11: patched: Fix merged into stable releases by Greg Kroah-Hartman