CVE-2026-53173: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53173 Overview

CVE-2026-53173 is a heap out-of-bounds write vulnerability in the Linux kernel's accel/ethosu driver. The flaw resides in the ethosu_gem_cmdstream_copy_and_validate() function, which parses command streams for the Arm Ethos-U neural processing unit accelerator. A boundary check is missing when the parser encounters a 64-bit command word, allowing a write four bytes past the end of a DMA-backed buffer. Userspace controls both the buffer contents and the size argument through an ioctl, making this a userspace-triggerable heap corruption. The vulnerability has been resolved in upstream kernel patches.

Critical Impact
Local unprivileged users with access to the Ethos-U accelerator device can trigger a heap out-of-bounds write, potentially leading to kernel memory corruption, denial of service, or privilege escalation.

Affected Products

Linux kernel versions containing the accel/ethosu driver prior to the fix
Systems exposing the Ethos-U DRM/accel device node to userspace
Embedded and edge platforms using the Arm Ethos-U NPU accelerator

Discovery Timeline

2026-06-25 - CVE-2026-53173 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53173

Vulnerability Analysis

The vulnerability is classified as an Out-of-Bounds Write [CWE-787] in the Ethos-U GEM command stream validation routine. The parser iterates through a command buffer in 4-byte words, copying each word into a destination buffer bocmds allocated through drm_gem_dma_create(ddev, size). The DMA allocation is exactly size bytes, giving valid indices from 0 to size/4 - 1.

When the parser encounters a command word with bit 14 set (cmd & 0x4000), it treats the command as a 64-bit extended form and writes a second word at index i+1. The loop manually increments i to consume the additional word but does not re-validate the new index against the buffer bound before performing the second write. When i == size/4 - 1 on entry and bit 14 is set, the second write at bocmds[size/4] overflows the allocation by four bytes.

Root Cause

The root cause is a missing bounds check between the auxiliary index increment and the dependent memory write. The loop condition i < size / 4 only guards the first write within each iteration. The second write, gated by the 0x4000 bit in the command word, bypasses that guard because the loop header is not re-evaluated mid-iteration.

Attack Vector

A local attacker with permission to open the Ethos-U accelerator device invokes the relevant ioctl with a crafted command stream and size argument. By placing a command word with bit 14 set at the final aligned offset of the buffer, the attacker forces the kernel to write four controlled bytes immediately past the DMA allocation. The adjacent heap memory determines exploitability, ranging from kernel panic to targeted heap object corruption.

The vulnerable parsing logic copies each 32-bit word and, on encountering a 64-bit command, increments the index and writes the second word without re-checking the loop bound. The upstream fix validates the incremented index against size / 4 before the second write and returns -EINVAL when the buffer cannot contain the extended command. See the Kernel Patch Update and stable backport for the corrected logic.

Detection Methods for CVE-2026-53173

Indicators of Compromise

Unexpected kernel oops, panic, or BUG: KASAN: slab-out-of-bounds messages referencing ethosu_gem_cmdstream_copy_and_validate
Processes with no legitimate need for NPU access opening /dev/accel/accel* or related Ethos-U device nodes
Crashes in drm_gem_dma_create allocation regions during NPU ioctl activity

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and pre-production kernels to surface the four-byte overflow at the moment of corruption
Audit ioctl calls targeting the Ethos-U accelerator and correlate command stream sizes against process identity and expected workload
Monitor dmesg and the kernel ring buffer for repeated -EINVAL returns from the Ethos-U command stream path after patching, indicating attempted exploitation

Monitoring Recommendations

Collect kernel crash dumps and oops traces centrally for triage of memory corruption patterns near DRM/GEM allocations
Track which accounts and containers hold access to NPU device nodes through Linux Discretionary Access Control and cgroup device controllers
Alert on kernel module loads for ethosu on systems where the accelerator is not expected to be in use

How to Mitigate CVE-2026-53173

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the mainline commit and the stable tree backport
Restrict access to Ethos-U accelerator device nodes to trusted system services only
Rebuild and redeploy kernels for embedded and edge devices using the Ethos-U NPU

Patch Information

The fix adds a bounds check on the incremented index before the second word write in ethosu_gem_cmdstream_copy_and_validate(). When the incremented index would exceed size / 4, the function returns -EINVAL instead of writing past the DMA buffer. Distribution maintainers should pick up both the mainline commit c0837b9cf6eabbad8b8cbddaff1a46a6d0a2e29d and the stable backport db6cb3e35cebf487f9a78ebd4cfa4b83708ff40d.

Workarounds

Remove or blacklist the ethosu kernel module on systems that do not require NPU acceleration
Tighten permissions on /dev/accel/* device nodes so that only privileged service accounts can issue ioctl calls
Use seccomp or container security profiles to block the relevant ioctl numbers for workloads that should not interact with the NPU

bash

# Configuration example: deny access to the Ethos-U accel device
echo 'blacklist ethosu' | sudo tee /etc/modprobe.d/blacklist-ethosu.conf
sudo chmod 0600 /dev/accel/accel0
sudo chown root:root /dev/accel/accel0