PT-2026-52268 · Linux · Linux
Publicado
2026-06-25
·
Atualizado
2026-06-25
·
CVE-2026-53172
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
accel/ethosu: fix IFM region index out-of-bounds in command stream parser
NPU SET IFM REGION extracts the region index with param & 0x7f, giving
a maximum value of 127. However region size[] and output region[] in
struct ethosu validated cmdstream info are both sized to
NPU BASEP REGION MAX (8), giving valid indices [0..7].
Every other region assignment in the same switch uses param & 0x7:
NPU SET OFM REGION: st.ofm.region = param & 0x7;
NPU SET IFM2 REGION: st.ifm2.region = param & 0x7;
NPU SET WEIGHT REGION: st.weight[0].region = param & 0x7;
NPU SET SCALE REGION: st.scale[0].region = param & 0x7;
The 0x7f mask on IFM is inconsistent and appears to be a typo.
feat matrix length() and calc sizes() use the region index directly
as an array subscript into the kzalloc'd info struct:
info->region size[fm->region] = max(...);
A userspace caller supplying NPU SET IFM REGION with param > 7 causes
a write up to 127*8 = 1016 bytes past the start of region size[],
corrupting adjacent kernel heap data.
Fix by applying the same & 0x7 mask used by all other region
assignments.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux