CVE-2026-89976: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89976 Overview

CVE-2026-89976 is a Linux kernel vulnerability in the accel/ethosu driver, which supports the Arm Ethos-U neural processing unit. The flaw resides in ethosu_ioctl_submit_job(), which allocates a done_fence object before validating buffer handles. When validation fails, the error path calls ethosu_job_err_cleanup(), which frees the job but leaks the uninitialized fence. A scheduler dependency error can also allow ethosu_job_run() to return before dma_fence_init() executes, causing normal cleanup to pass a zeroed refcount to dma_fence_put().

Critical Impact

Improper cleanup of an uninitialized dma_fence can lead to kernel memory leaks and reference count corruption when submitting jobs to the Ethos-U accelerator driver.

Affected Products

• Linux kernel builds including the accel/ethosu driver
• Systems using Arm Ethos-U neural processing unit acceleration
• Downstream distributions shipping affected mainline kernel versions

Discovery Timeline

• 2026-09-16 - CVE-2026-89976 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89976

Vulnerability Analysis

The vulnerability affects the ioctl submit path in the accel/ethosu driver. ethosu_ioctl_submit_job() allocates a done_fence object early in the function, before validating user-supplied buffer handles. If handle validation fails, the driver executes ethosu_job_err_cleanup(), which releases the job structure but does not release the allocated fence. This leaves an uninitialized dma_fence allocation stranded in kernel memory.

A second condition compounds the issue. When a scheduler dependency error occurs, ethosu_job_run() can return before dma_fence_init() initializes the fence structure. The normal cleanup path subsequently calls dma_fence_put() on a fence whose reference count is still zero, triggering undefined behavior in the DMA fence subsystem.

The upstream fix relocates done_fence release into the common cleanup path. It uses dma_fence_was_initialized() to distinguish fences that reached dma_fence_init() from raw allocations that must be freed differently. The commit also corrects the affected goto target.

Root Cause

The root cause is inconsistent object lifetime management. The driver allocates the fence in one control flow branch but assumes cleanup will occur through a path that only handles fully initialized fences. This produces both a memory leak on the error path and a reference-counting fault on the scheduler error path.

Attack Vector

Exploitation requires local access with the ability to open the Ethos-U character device and issue the submit-job ioctl. A local user can trigger the flaw by submitting jobs with invalid buffer handles or crafted scheduler dependencies. See the fix commits 2d2a3adc919 and b3e0f79af1f for technical details.

Detection Methods for CVE-2026-89976

Indicators of Compromise

• Kernel log entries referencing dma_fence_put warnings or refcount underflow tied to the ethosu driver
• Growth in unreclaimable kernel slab allocations correlated with repeated ioctl failures on the Ethos-U device node
• Repeated failed job submissions from unprivileged user processes to /dev/accel/* nodes

Detection Strategies

• Audit kernel version and confirm whether patches 2d2a3adc919 or b3e0f79af1f are applied to the accel/ethosu driver
• Enable KASAN and SLUB_DEBUG in test environments to surface use-after-free and leak conditions in the fence path
• Monitor dmesg for WARN_ON output originating from drivers/dma-buf/dma-fence.c

Monitoring Recommendations

• Track ioctl syscall failure rates against the Ethos-U device from non-root processes
• Alert on kernel taint transitions and repeated fence subsystem warnings on affected hosts
• Correlate slab memory growth with workloads exercising the neural accelerator driver

How to Mitigate CVE-2026-89976

Immediate Actions Required

• Apply the upstream kernel patches referenced in the stable tree commits 2d2a3adc919 and b3e0f79af1f
• Restrict access to the Ethos-U accelerator device node to trusted service accounts only
• Rebuild and redeploy vendor kernels that carry the accel/ethosu driver once the fix is backported

Patch Information

The fix releases done_fence in the common cleanup path and uses dma_fence_was_initialized() to differentiate initialized fences from raw allocations. The corresponding goto target was also corrected. See Kernel Git Commit 2d2a3adc919 and Kernel Git Commit b3e0f79af1f.

Workarounds

• Unload the ethosu kernel module on hosts that do not require neural accelerator functionality
• Apply Linux capability or udev rules to prevent unprivileged users from opening the Ethos-U device node
• Disable Ethos-U support in kernel configuration (CONFIG_DRM_ACCEL_ETHOSU) where the accelerator is not used