Linux Kernel CVE-2026-53169

The upstream fix is available in Linux kernel 7.0.13 and 7.1 (stable commits 70090a32 and ef911805 respectively), which replaces the unconditional WARN_ON(1) with an explicit -EINVAL return, causing the ioctl to reject NPU_OP_RESIZE before it reaches hardware. Administrators should apply their distribution's kernel update incorporating these stable commits as the primary remediation. For systems that cannot be immediately patched, restrict access to the DRM device node (typically /dev/dri/renderD* or /dev/dri/card*) to trusted users only via udev rules or filesystem permissions - this raises the required privilege level and eliminates unprivileged exploitation. Additionally, removing panic_on_warn=1 from kernel boot parameters (if present) eliminates the kernel-panic escalation path, degrading the worst-case impact from system crash to log spam; note this changes kernel hardening posture and should be evaluated against site policy. Disabling the ethosu kernel module entirely (rmmod ethosu or blacklisting it) on systems without Arm Ethos-U NPU hardware removes the attack surface completely with no functional trade-off.