Linux Kernel EUVD-2026-55431

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix DMA direction for NPU mailbox buffer

airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer:

• airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into

the buffer, then the caller reads it via memcpy()

• airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back

npu_stats_addr field in the response

On non-cache-coherent architectures like EN7581 (Cortex-A53 without hardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op

• it does not invalidate the CPU cache. If the NPU-written cache line

is still present in the CPU cache when the caller reads the buffer, the CPU observes stale data instead of the NPU response.

This is a timing-sensitive bug: small mailbox buffers (~24 bytes) typically fit in a single cache line and may survive in the cache until the caller reads them, producing silent data corruption rather than a crash. The bug is more likely to trigger when the caller reads the response immediately after dma_unmap_single() without intervening cache-evicting operations.

Fix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures dma_unmap_single() invalidates the CPU cache on non-coherent systems. The mailbox buffers are small so there is no performance concern.