CVE-2026-53171: Linux Kernel Privilege Escalation Flaw

CVE-2026-53171 Overview

CVE-2026-53171 affects the Linux kernel's accel/ethosu driver, which supports the Arm Ethos-U neural processing unit (NPU). The vulnerability resides in the dma_length() function, which derives Direct Memory Access (DMA) region usage from command stream values. Multiple arithmetic issues, including signed integer underflow, multiplication overflow, and offset addition overflow, can corrupt the derived region_size[] values. Because region_size[] is later used to validate command stream accesses against Graphics Execution Manager (GEM) buffer sizes, arithmetic wraparound can under-report region usage and bypass bounds validation. The kernel maintainers resolved the issue by validating signed additions, using overflow helpers, and propagating dma_length() failures to the caller.

Critical Impact
Arithmetic wraparound in dma_length() allows command streams to bypass GEM buffer bounds validation, enabling out-of-bounds DMA access on systems using the Arm Ethos-U NPU.

Affected Products

Linux kernel accel/ethosu driver (Arm Ethos-U NPU support)
Upstream Linux kernel versions prior to the fix commits 6bb73845d185 and ee6d9b6e5162
Linux distributions shipping the affected accel/ethosu driver

Discovery Timeline

2026-06-25 - CVE-2026-53171 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53171

Vulnerability Analysis

The dma_length() function in the accel/ethosu driver calculates the DMA region length using the formula len = ((len + stride[0]) * size0 + stride[1]) * size1. The result is then combined with dma->offset and stored in the region_size[] array via a max() update. This array is consumed by ethosu_job.c to enforce that command stream accesses remain within their associated GEM buffer boundaries.

Four distinct arithmetic problems undermine the calculation. Signed stride values can underflow len when added. Intermediate multiplications by size0 and size1 can overflow native integer width. The final len + dma->offset computation can wrap during region_size[] updates. Finally, the caller never validated the return value of dma_length(), so error paths silently produced corrupted region sizes.

When any of these wraparounds occur, the computed region size becomes smaller than the actual range the command stream will touch. The bounds validation in ethosu_job.c then approves accesses that read or write outside the bound GEM buffer.

Root Cause

The root cause is unchecked integer arithmetic [CWE-190, CWE-191] across signed addition, multiplication, and offset accumulation in dma_length(), combined with missing error propagation from the function to its caller.

Attack Vector

Exploitation requires submitting a crafted command stream to the Ethos-U NPU through the driver's user-space interface. An attacker with the ability to submit jobs can supply stride and size values that force wraparound in dma_length(), shrinking the recorded region_size[] value. Subsequent command stream operations then perform DMA reads or writes beyond the bound GEM buffer, resulting in out-of-bounds kernel memory access.

No verified public proof-of-concept is available. See the upstream commits 6bb73845d185 and ee6d9b6e5162 for the corrective patches.

Detection Methods for CVE-2026-53171

Indicators of Compromise

Kernel log entries from the accel/ethosu subsystem reporting unexpected DMA validation failures or job submission errors after patching.
Process crashes, kernel oopses, or memory corruption traces originating from ethosu_job.c bounds-check paths.
Anomalous user-space processes submitting malformed Ethos-U command streams with extreme stride or size field values.

Detection Strategies

Audit installed kernel versions across Linux fleets and compare against the upstream fix commits to identify unpatched systems.
Monitor dmesg and journald logs for warnings emitted by overflow helpers (check_add_overflow, check_mul_overflow) in DMA paths.
Inspect access to /dev/accel/ device nodes and correlate with non-privileged processes interacting with the NPU.

Monitoring Recommendations

Enable kernel auditing for device file opens on Ethos-U accelerator nodes and forward events to a centralized log platform.
Track kernel crash telemetry for repeated faults in accel/ethosu call paths that may signal exploitation attempts.
Use endpoint detection telemetry to flag unprivileged processes opening accelerator devices outside of expected workloads.

How to Mitigate CVE-2026-53171

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 6bb73845d185 and ee6d9b6e5162 or upgrade to a stable kernel release containing both fixes.
Inventory systems that load the ethosu driver, including Arm-based embedded devices and AI/ML accelerator hosts.
Restrict access to Ethos-U device nodes to trusted users and service accounts only.

Patch Information

The fix validates signed additions before they are applied to len, uses kernel overflow helpers (check_add_overflow, check_mul_overflow) for intermediate multiplications and offset accumulation, and ensures dma_length() failures are propagated to the caller so command streams with invalid arithmetic are rejected. Refer to the kernel.org commit 6bb73845d185 and kernel.org commit ee6d9b6e5162 for the authoritative source changes.

Workarounds

Unload the ethosu kernel module on systems that do not require Arm Ethos-U NPU functionality using modprobe -r ethosu.
Blacklist the module via /etc/modprobe.d/ to prevent automatic loading until patched kernels are deployed.
Apply mandatory access controls (SELinux, AppArmor) to deny non-root processes access to /dev/accel/ device nodes.

bash

# Configuration example: blacklist the ethosu driver until patched
echo "blacklist ethosu" | sudo tee /etc/modprobe.d/blacklist-ethosu.conf
sudo modprobe -r ethosu
sudo update-initramfs -u