CVE-2026-89977 Overview
CVE-2026-89977 affects the Linux kernel's accel/ethosu driver, which supports Arm Ethos-U neural network accelerators. The ethosu_probe() function fails to validate the return value of devm_platform_ioremap_resource() before using the mapped MMIO region. When the register resource cannot be mapped, the function returns an error pointer that the driver stores and later dereferences through MMIO accessors during device initialization. This leads to a kernel oops or undefined behavior on affected systems.
Critical Impact
Local attackers or faulty hardware conditions can trigger a kernel crash through an unchecked error pointer dereference in the Ethos-U accelerator driver probe path.
Affected Products
- Linux kernel builds containing the accel/ethosu driver
- Systems using Arm Ethos-U neural network accelerators
- Kernel branches referenced by commits 7ab64476a610 and f7aad73b4811
Discovery Timeline
- 2026-09-16 - CVE-2026-89977 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89977
Vulnerability Analysis
The flaw is a missing error check in the driver probe routine, classified as an improper error handling issue that results in an invalid pointer dereference [CWE-690]. The devm_platform_ioremap_resource() helper returns an ERR_PTR() encoded value when it cannot map a platform device's register region. Instead of testing this return value with IS_ERR(), ethosu_probe() assigns it to the driver's MMIO base pointer and continues initialization. Subsequent MMIO accessor calls dereference the encoded error value, treating it as a valid virtual address.
Root Cause
The root cause is the absence of an IS_ERR() check after devm_platform_ioremap_resource() in ethosu_probe(). Kernel error pointers are values in the top of the address space encoded via ERR_PTR(-errno). Using them as MMIO addresses produces a fault when the accessor performs a load or store. The fix returns the mapping error immediately before any device initialization steps run.
Attack Vector
The vulnerability triggers during device probing when the register resource is invalid, unavailable, or fails to map. On systems with faulty device tree data, hardware configuration issues, or attacker-influenced ACPI or DT descriptors, probing the Ethos-U driver produces a kernel oops. Exploitation requires the driver to be loaded and a probe to run against a resource that fails mapping, so local privileges or physical access to influence platform data are typical prerequisites.
See the upstream fixes at Kernel Git Commit 7ab6447 and Kernel Git Commit f7aad73 for the exact patch content.
Detection Methods for CVE-2026-89977
Indicators of Compromise
- Kernel oops or panic messages referencing ethosu_probe in the call stack
- BUG: unable to handle page fault entries pointing to Ethos-U MMIO accessor functions
- Repeated probe failures for the accel/ethosu driver in dmesg
Detection Strategies
- Monitor dmesg and journalctl -k for probe-time faults in the accel/ethosu driver
- Audit kernel version and configuration to identify builds that include the driver without the referenced fix commits
- Correlate device tree or ACPI changes with subsequent driver probe failures on Ethos-U hardware
Monitoring Recommendations
- Forward kernel logs to a centralized logging pipeline and alert on oops signatures involving ethosu_* symbols
- Track kernel package versions across the Linux fleet and flag hosts still running vulnerable builds
- Include Ethos-U driver load and probe events in host telemetry to detect abnormal reload patterns
How to Mitigate CVE-2026-89977
Immediate Actions Required
- Apply the upstream kernel patch that returns the mapping error before initializing the Ethos-U device
- Update to a stable kernel release that includes commits 7ab64476a610 and f7aad73b4811
- Restrict local access on systems exposing the Ethos-U accelerator until patched
Patch Information
The fix adds an IS_ERR() check on the return value of devm_platform_ioremap_resource() in ethosu_probe() and returns the error before the driver dereferences the pointer. Reference the patches at Kernel Git Commit 7ab6447 and Kernel Git Commit f7aad73.
Workarounds
- Blacklist the accel/ethosu module on systems that do not require the accelerator
- Validate device tree and ACPI descriptions to ensure the Ethos-U register resource is correctly defined
- Defer driver loading until a patched kernel is available on production hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
