CVE-2026-68330: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68330 Overview

CVE-2026-68330 is a Linux kernel vulnerability in the Airoha Network Processing Unit (NPU) driver. The airoha_npu_send_msg() function maps the mailbox buffer with DMA_TO_DEVICE, but callers such as airoha_npu_wlan_msg_get() and airoha_npu_ppe_stats_setup() expect the NPU to write response data back into that same buffer. On non-cache-coherent architectures like EN7581 (Cortex-A53 without hardware cache coherency for NPU DMA), the incorrect direction prevents cache invalidation on unmap. The CPU then reads stale cache lines instead of the NPU response, producing silent data corruption.

Critical Impact
Local attackers with driver-adjacent access can trigger silent data corruption in kernel-controlled network processing paths, undermining confidentiality, integrity, and availability on affected systems.

Affected Products

Linux kernel with the Airoha NPU driver enabled
Airoha EN7581 SoC platforms using Cortex-A53 without hardware cache coherency for NPU DMA
Systems relying on Airoha PPE statistics and WLAN NPU mailbox operations

Discovery Timeline

2026-08-10 - CVE-2026-68330 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68330

Vulnerability Analysis

The defect resides in the Linux kernel's Airoha NPU mailbox handling. The function airoha_npu_send_msg() unconditionally maps the mailbox buffer with DMA_TO_DEVICE, indicating a one-way transfer from CPU to device. Two callers, airoha_npu_wlan_msg_get() (NPU_OP_GET) and airoha_npu_ppe_stats_setup() (NPU_OP_SET), depend on the NPU writing response data back into the same buffer. The caller then reads the response using memcpy() or reads the npu_stats_addr field.

On architectures without hardware cache coherency for NPU DMA, dma_unmap_single() with DMA_TO_DEVICE is a no-op for cache management. The kernel does not invalidate the CPU cache lines corresponding to the buffer. Because mailbox buffers are small (approximately 24 bytes) and typically fit within a single cache line, the stale CPU-cached data persists and shadows the NPU-written response.

Root Cause

The root cause is an incorrect DMA direction specification in a shared mailbox path [CWE-1037-adjacent memory synchronization issue]. DMA_TO_DEVICE does not trigger cache invalidation on unmap, which is required whenever the device writes into the buffer. The correct direction for bidirectional mailbox traffic is DMA_BIDIRECTIONAL, which ensures both cache flush on map and cache invalidation on unmap.

Attack Vector

Exploitation requires local access with the privileges necessary to invoke the affected code paths. The bug is timing-sensitive and depends on the mailbox cache line surviving in the CPU cache until the caller reads the response. Reads issued immediately after dma_unmap_single() without intervening cache-evicting operations are the most likely to observe stale data. The result is silent data corruption in network processing statistics or WLAN command responses rather than an immediate crash.

See the upstream fix commits 4c4d866, 6f884eb, and 76fc560 for the corrected DMA direction handling.

Detection Methods for CVE-2026-68330

Indicators of Compromise

Unexplained inconsistencies in PPE statistics counters reported through the Airoha NPU driver on EN7581 platforms.
Anomalous or malformed responses from airoha_npu_wlan_msg_get() observed in kernel logs or WLAN control paths.
Kernel builds containing the Airoha NPU driver without the referenced upstream fix commits applied.

Detection Strategies

Audit installed kernel versions and confirm the presence of the fix commits 4c4d866, 6f884eb, and 76fc560 in the Airoha NPU driver source.
Correlate NPU statistics anomalies with WLAN and PPE workload timing to identify silent corruption windows.
Monitor system logs for repeated retries or command failures involving the NPU mailbox interface.

Monitoring Recommendations

Track kernel package versions across EN7581-based fleet devices and flag hosts running unpatched Airoha NPU code.
Alert on abnormal PPE statistics drift compared with independent network counters.
Capture and retain kernel logs from affected devices for post-incident analysis of NPU response anomalies.

How to Mitigate CVE-2026-68330

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 4c4d866, 6f884eb, and 76fc560.
Rebuild and redeploy kernels for Airoha EN7581 platforms and any device using the Airoha NPU driver.
Restrict local access on affected devices to trusted administrators until patches are deployed.

Patch Information

The fix changes both dma_map_single() and dma_unmap_single() calls for the NPU mailbox buffer from DMA_TO_DEVICE to DMA_BIDIRECTIONAL. This ensures the CPU cache is invalidated on unmap so callers observe the NPU-written response rather than stale cache data. Because the mailbox buffers are small, the change introduces no measurable performance impact.

Workarounds

No configuration-based workaround eliminates the underlying cache coherency issue; patching is required.
Limit workloads that exercise NPU_OP_GET and PPE statistics paths on unpatched systems to reduce exposure.
Where feasible, disable the Airoha NPU driver on non-cache-coherent platforms until the kernel update is applied.

bash

# Verify installed kernel version and confirm the Airoha NPU fix is present
uname -r
grep -R "DMA_BIDIRECTIONAL" drivers/net/ethernet/airoha/airoha_npu.c