Skip to main content

Linux Kernel EUVDEUVD-2026-39262

| CVE-2026-53171 HIGH
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vp3v-wxjh-fcp5
Buffer Overflow Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local job submission needs device access so AV:L/PR:L; reliable arithmetic trigger gives AC:L; bounds bypass corrupts kernel memory beyond the buffer, justifying S:C and C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:19 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: fix arithmetic issues in dma_length()

dma_length() derives DMA region usage from command stream values and updates region_size[]:

len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset)

Several arithmetic issues can corrupt the derived region size:

  • signed stride values may underflow when added to len
  • intermediate multiplications may overflow
  • len + dma->offset may overflow during region_size updates
  • dma_length() error returns were not validated by the caller

region_size[] is later used by ethosu_job.c to validate command stream accesses against GEM buffer sizes. Arithmetic wraparound can therefore under-report region usage and bypass the bounds validation.

Fix by validating signed additions, using overflow helpers for multiplications and offset updates, and propagating dma_length() failures to the caller.

AnalysisAI

Local privilege escalation and kernel memory corruption in the Linux kernel's Arm Ethos-U NPU accelerator driver (accel/ethosu) arises from unchecked arithmetic in dma_length(), allowing a local user with access to the accelerator device to submit a crafted command stream that wraps around integer math and under-reports DMA region sizes. Because region_size[] is later used by ethosu_job.c to validate command-stream accesses against GEM buffer sizes, the wraparound bypasses bounds checking and permits out-of-bounds DMA access (CVSS 3.1 8.8). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).

Technical ContextAI

The affected component is the Arm Ethos-U microNPU (neural processing unit) accelerator driver under the kernel's accel/ subsystem, which exposes a DRM/accel device node and consumes a command stream describing tensor operations and the DMA regions they touch. The dma_length() helper derives DMA region usage from attacker-influenced command-stream values using the formula len = ((len + stride[0]) * size0 + stride[1]) * size1, then updates region_size[region] = max(..., len + dma->offset). The root cause is a classic integer-overflow / signed-underflow class (CWE-190/CWE-191, listed as N/A in the source feed): signed stride values can underflow when added to len, intermediate multiplications can overflow, and the offset addition can wrap. These derived sizes feed GEM buffer bounds validation, so corrupting them turns an arithmetic bug into a memory-safety bypass. The fix validates signed additions, uses kernel overflow helpers (check_*_overflow) for multiplications and offset updates, and propagates dma_length() error returns to the caller, which previously ignored them.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel stable commits 6bb73845d1855ceaf50e397175e5979a7bdf69bc and ee6d9b6e51626f259c6f0e38d94f91be4fd14754 (https://git.kernel.org/stable/c/6bb73845d1855ceaf50e397175e5979a7bdf69bc and https://git.kernel.org/stable/c/ee6d9b6e51626f259c6f0e38d94f91be4fd14754), or update to a stable kernel that includes them (EUVD maps fixes to versions reported as 7.0.13 and 7.1; verify against your distribution's changelog before relying on those numbers). If you cannot patch immediately, reduce exposure by not loading the ethosu accel module on systems that do not require the Arm Ethos-U NPU (blacklist the module), and restrict permissions on the accelerator device node so only trusted service accounts - not general local users - can submit command-stream jobs; the trade-off is that any legitimate NPU workload running under restricted accounts will lose access until the driver is patched and re-enabled.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39262 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy