Executive brief
The Arm Ethos-U neural processing unit driver in the Linux kernel failed to validate register memory mapping during device initialization. A failed memory mapping could cause the driver to attempt hardware access through an invalid pointer, resulting in a kernel crash or system instability.
Technical details
The vulnerability exists in the ethosu_probe() function in drivers/accel/ethosu/ethosu_drv.c. The devm_platform_ioremap_resource() call returns an error pointer (using the ERR_PTR macro) when register resource mapping fails, but the driver previously did not check for this error before proceeding with device initialization. An attacker with the ability to trigger device hotplug/probe events on a system with the Ethos-U driver could exploit improper resource mapping to cause a NULL pointer dereference or other kernel crash. The fix adds an IS_ERR() check immediately after the ioremap call and returns the error code before any MMIO accessors are called.
Affected products
- Linux Linux kernel versions including accel: Add Arm Ethos-U NPU driver through at least 6.9
Timeline
- 2026-07-16: other: Patch authored
- 2026-08-24: disclosed: Patch committed upstream
- 2026-09-11: patched: Patch included in stable trees
- 2026-09-16: advisory: Published as CVE-2026-89977