CVE-2026-53172: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53172 Overview

CVE-2026-53172 is an out-of-bounds write vulnerability in the Linux kernel's accel/ethosu driver, which supports the Arm Ethos-U Neural Processing Unit (NPU). The flaw resides in the command stream parser, where the NPU_SET_IFM_REGION opcode extracts a region index using an incorrect bitmask of 0x7f instead of 0x7. The resulting index can exceed the bounds of fixed-size arrays in struct ethosu_validated_cmdstream_info, corrupting adjacent kernel heap memory. A userspace caller submitting a crafted command stream can trigger the corruption.

Critical Impact
A local userspace process can write up to 1016 bytes past a kernel heap allocation, enabling kernel memory corruption that may lead to privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the accel/ethosu driver with the affected command stream parser
Systems with Arm Ethos-U NPU accelerator support enabled
Distributions shipping vulnerable stable kernels prior to the fix commits

Discovery Timeline

2026-06-25 - CVE-2026-53172 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53172

Vulnerability Analysis

The accel/ethosu driver parses NPU command streams submitted from userspace and validates region indices that map buffers into the NPU's address space. The struct ethosu_validated_cmdstream_info contains two arrays, region_size[] and output_region[], both sized to NPU_BASEP_REGION_MAX (8 entries, valid indices 0..7).

For every region-setting opcode except one, the parser correctly masks the parameter with & 0x7:

NPU_SET_OFM_REGION assigns st.ofm.region = param & 0x7
NPU_SET_IFM2_REGION assigns st.ifm2.region = param & 0x7
NPU_SET_WEIGHT_REGION assigns st.weight[0].region = param & 0x7
NPU_SET_SCALE_REGION assigns st.scale[0].region = param & 0x7

The NPU_SET_IFM_REGION handler uses param & 0x7f, allowing region values up to 127. Helper functions feat_matrix_length() and calc_sizes() later use the unchecked index as a direct array subscript, writing into info->region_size[fm->region].

Root Cause

The root cause is a typo in the bitmask applied to the IFM region parameter. The inconsistent 0x7f mask permits indices well beyond the array bound of 8, producing a classic out-of-bounds write [CWE-787]. No bounds check exists between the masking operation and the array subscript, so the corrupted index propagates directly into pointer arithmetic against the kzalloc-allocated info struct.

Attack Vector

A local attacker with the ability to submit command streams to the Ethos-U device file crafts a stream containing an NPU_SET_IFM_REGION opcode with a parameter greater than 7. When the parser computes info->region_size[fm->region] = max(...), the write lands up to 127 * 8 = 1016 bytes past the start of region_size[]. The corrupted slab memory can overlap adjacent kernel objects, enabling further exploitation paths such as control-flow hijack or privilege escalation depending on heap layout.

The vulnerability mechanism is documented in the upstream fix commits. See the kernel.org stable commit 00f547e0 and kernel.org stable commit ee7bed77 for the exact code change applying & 0x7 to the IFM region assignment.

Detection Methods for CVE-2026-53172

Indicators of Compromise

Unexpected kernel oops or BUG reports referencing feat_matrix_length, calc_sizes, or ethosu_validated_cmdstream_info in stack traces
KASAN slab-out-of-bounds reports tagged against the accel/ethosu driver and region_size field
Unprivileged processes opening the Ethos-U device node and issuing large or malformed command streams

Detection Strategies

Enable CONFIG_KASAN on test or canary kernels to surface out-of-bounds writes from the command stream parser
Audit kernel logs for crashes originating in the accel/ethosu module after userspace NPU activity
Inventory hosts loading the ethosu driver and confirm whether they run a patched kernel

Monitoring Recommendations

Collect kernel ring buffer (dmesg) and journald events from systems exposing NPU device files to userspace
Track process access to /dev/ethosu* device nodes and alert on access by non-allowlisted binaries
Forward kernel crash dumps to a central data lake for correlation against the affected call sites

How to Mitigate CVE-2026-53172

Immediate Actions Required

Update affected systems to a Linux kernel release containing the upstream fix commits 00f547e0 and ee7bed77
Restrict access to the Ethos-U device node so only trusted service accounts can submit command streams
Disable or unload the ethosu kernel module on hosts that do not require NPU acceleration

Patch Information

The fix replaces the param & 0x7f mask with param & 0x7 in the NPU_SET_IFM_REGION handler, aligning IFM region parsing with the other region opcodes and constraining indices to the valid [0..7] range. Patches are available in the kernel.org stable commit 00f547e0 and kernel.org stable commit ee7bed77. Apply distribution kernel updates as soon as vendors publish backports.

Workarounds

Blacklist the ethosu module via /etc/modprobe.d/ on systems that do not use NPU workloads
Tighten permissions on the Ethos-U character device so only privileged accelerator services can open it
Apply mandatory access control policies (SELinux, AppArmor) to confine processes interacting with the NPU driver

bash

# Configuration example: prevent the vulnerable driver from loading
echo "blacklist ethosu" | sudo tee /etc/modprobe.d/blacklist-ethosu.conf
sudo depmod -a
sudo update-initramfs -u