CVE-2026-53169: Linux Kernel Ethosu DoS Vulnerability

CVE-2026-53169 Overview

CVE-2026-53169 affects the Linux kernel accel/ethosu driver for Arm Ethos-U Neural Processing Units (NPUs). The driver contains a WARN_ON(1) placeholder for the unimplemented NPU_OP_RESIZE command, a U85-only operation. Any unprivileged user with access to the Direct Rendering Manager (DRM) device can submit this command through the DRM_IOCTL_ETHOSU_GEM_CREATE ioctl. The warning fires unconditionally, producing unbounded kernel log spam. When panic_on_warn is enabled, the kernel panics, giving local attackers a trivial denial-of-service primitive. The upstream fix replaces the warning with an explicit -EINVAL return so the ioctl rejects the command before it reaches hardware.

Critical Impact
Unprivileged local users with DRM device access can flood kernel logs or trigger a kernel panic on systems configured with panic_on_warn.

Affected Products

Linux kernel versions containing the accel/ethosu driver with the unimplemented NPU_OP_RESIZE handler
Systems exposing the Arm Ethos-U NPU DRM device to unprivileged users
Kernels configured with panic_on_warn enabled

Discovery Timeline

2026-06-25 - CVE-2026-53169 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53169

Vulnerability Analysis

The accel/ethosu driver provides userspace access to Arm Ethos-U NPU hardware through the DRM subsystem. Userspace submits command streams to the NPU using the DRM_IOCTL_ETHOSU_GEM_CREATE ioctl. The driver parses these command streams and dispatches handlers for each opcode.

NPU_OP_RESIZE is a command specific to the Ethos-U85 hardware variant. The driver does not yet implement support for it. Instead of returning an error when the command is encountered, the driver invokes WARN_ON(1) as a placeholder. This produces a full kernel warning with stack trace each time the command is parsed.

The Exploit Prediction Scoring System (EPSS) score is 0.155% with a percentile of 5.021, reflecting the local-only attack surface. The flaw is best categorized as a Denial of Service through kernel log flooding and conditional kernel panic.

Root Cause

The root cause is the use of WARN_ON(1) as an error path for a userspace-reachable code path. Kernel warning macros are intended for assertions about kernel invariants, not for handling invalid input from unprivileged callers. Because the command opcode is supplied directly by userspace, an attacker controls when the warning fires.

Attack Vector

An unprivileged local user with read or write access to the Ethos-U DRM device node opens the device and submits a crafted command buffer through DRM_IOCTL_ETHOSU_GEM_CREATE. The buffer contains the NPU_OP_RESIZE opcode. The driver parses the command, hits the WARN_ON(1) placeholder, and either emits a stack trace to the kernel log or panics the system if panic_on_warn is set. Repeated submissions exhaust log storage or saturate logging infrastructure.

The vulnerability mechanism is described in the upstream commit message. See the Kernel Patch Update and Kernel Patch Change for the corrective change.

Detection Methods for CVE-2026-53169

Indicators of Compromise

Repeated kernel log entries containing WARN_ON stack traces originating from the accel/ethosu driver call paths
Unexpected kernel panics on systems with panic_on_warn=1 and Ethos-U hardware present
Unprivileged processes opening /dev/dri/accel* nodes associated with the Ethos-U driver

Detection Strategies

Monitor dmesg and /var/log/kern.log for high-frequency warning traces referencing the ethosu driver or NPU_OP_RESIZE opcode
Audit ioctl calls to DRM_IOCTL_ETHOSU_GEM_CREATE from non-root processes using auditd or eBPF tracing
Track kernel log volume baselines and alert on sudden spikes from a single user or process

Monitoring Recommendations

Enable kernel audit rules covering DRM device access on Ethos-U enabled hardware
Forward kernel logs to a centralized log aggregation system to retain evidence after a panic
Review the running kernel version against the patched commits to confirm exposure status

How to Mitigate CVE-2026-53169

Immediate Actions Required

Apply the upstream Linux kernel patches that replace WARN_ON(1) with -EINVAL for NPU_OP_RESIZE
Disable panic_on_warn on affected hosts until the patched kernel is deployed to prevent denial of service via panic
Restrict access to the Ethos-U DRM device node to trusted users and groups only

Patch Information

The vulnerability is resolved by upstream commits 70090a32f56a4589e7e860e0f9a8fbe4417df0a1 and ef911805d86a05363d3ec2fa9835a41def83bb7e. Both modify the accel/ethosu driver to return -EINVAL from the ioctl handler when an unimplemented NPU_OP_RESIZE command arrives from userspace. Rebuild and deploy a kernel containing these commits, or install a vendor kernel update that backports them.

Workarounds

Tighten permissions on the Ethos-U DRM device node so only trusted system services can open it
Set sysctl kernel.panic_on_warn=0 to prevent the warning from escalating to a full system panic
Remove or blacklist the ethosu kernel module on systems that do not require NPU acceleration

bash

# Configuration example: reduce blast radius until the patch is deployed
sysctl -w kernel.panic_on_warn=0
chgrp video /dev/dri/accel0
chmod 0660 /dev/dri/accel0