CVE-2026-53171 Details
Description
In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage from command stream values and updates region_size[]: len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset) Several arithmetic issues can corrupt the derived region size: - signed stride values may underflow when added to len - intermediate multiplications may overflow - len + dma->offset may overflow during region_size updates - dma_length() error returns were not validated by the caller region_size[] is later used by ethosu_job.c to validate command stream accesses against GEM buffer sizes. Arithmetic wraparound can therefore under-report region usage and bypass the bounds validation. Fix by validating signed additions, using overflow helpers for multiplications and offset updates, and propagating dma_length() failures to the caller.
A vulnerability in the Linux kernel's Arm Ethos-U NPU driver has been addressed. The issue arose in the 'dma_length()' function, which calculates DMA region usage based on command stream values and updates the 'region_size' array. Several arithmetic problems could lead to incorrect region size calculations: signed stride values might underflow when added to the length, intermediate multiplications could overflow, and the sum of length and DMA offset might exceed limits during region size updates. Additionally, errors from 'dma_length()' were not properly validated by the caller. This could allow the command stream to access GEM buffer sizes incorrectly, potentially under-reporting region usage and bypassing necessary bounds validation. The vulnerability has been fixed by adding checks to validate signed additions, using overflow-safe methods for multiplications and offset updates, and ensuring that 'dma_length()' errors are communicated back to the caller.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit containing the fix can be downloaded as part of the Linux kernel stable release.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/6bb73845d1855ceaf50e397175e5979a7bdf69bc | kernel.org | Patch |
| https://git.kernel.org/stable/c/ee6d9b6e51626f259c6f0e38d94f91be4fd14754 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.19, < 7.0.13 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 7.1 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 25, 2026 | New CVE Received | kernel.org |