CVE-2026-53170

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> accel/ethosu: reject DMA commands with uninitialized length<br /> <br /> cmd_state_init() initializes the command state with memset(0xff),<br /> leaving dma-&gt;len at U64_MAX to signal missing setup. The only setter<br /> is NPU_SET_DMA0_LEN; if userspace omits this command and issues<br /> NPU_OP_DMA_START, dma-&gt;len remains U64_MAX.<br /> <br /> In dma_length(), a positive stride added to U64_MAX wraps to a small<br /> value. With size0 == 1, check_mul_overflow() does not trigger and<br /> dma_length() returns 0 instead of U64_MAX. The caller&amp;#39;s U64_MAX check<br /> then passes, region_size[] stays 0, and the bounds check in<br /> ethosu_job.c is bypassed, allowing hardware to execute DMA with stale<br /> physical addresses.<br /> <br /> Fix by checking for U64_MAX at the start of dma_length() before any<br /> arithmetic, consistent with the sentinel value used throughout the<br /> driver to detect uninitialized fields.