Linux Kernel CVE-2026-53170

The Ethos-U is Arm's microNPU machine-learning accelerator; its Linux kernel driver lives under drivers/accel/ethosu and exposes a command-stream interface to userspace for programming DMA-driven inference jobs. The driver initializes per-command state with memset(0xff) in cmd_state_init(), so dma->len defaults to U64_MAX as an 'unset' sentinel, with NPU_SET_DMA0_LEN being the only legitimate setter. The root cause is an unvalidated/uninitialized field combined with an integer overflow (CWE-457 use of uninitialized value plus CWE-190 integer wraparound, despite the upstream CWE being listed as N/A): in dma_length(), adding a positive stride to U64_MAX wraps to a small value, and with size0 1 the check_mul_overflow() guard does not fire, so dma_length() returns 0 rather than the U64_MAX sentinel the caller expects. The caller's U64_MAX guard is therefore never reached, region_size[] remains 0, and the subsequent bounds check in ethosu_job.c is bypassed, permitting the NPU's DMA hardware to issue transfers using stale, attacker-influenced physical addresses. The fix short-circuits dma_length() to return U64_MAX immediately when len U64_MAX, before any arithmetic, matching the sentinel handling used elsewhere in the driver.