CVE-2026-53171

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> accel/ethosu: fix arithmetic issues in dma_length()<br /> <br /> dma_length() derives DMA region usage from command stream values and<br /> updates region_size[]:<br /> <br /> len = ((len + stride[0]) * size0 + stride[1]) * size1<br /> region_size[region] = max(..., len + dma-&gt;offset)<br /> <br /> Several arithmetic issues can corrupt the derived region size:<br /> <br /> - signed stride values may underflow when added to len<br /> - intermediate multiplications may overflow<br /> - len + dma-&gt;offset may overflow during region_size updates<br /> - dma_length() error returns were not validated by the caller<br /> <br /> region_size[] is later used by ethosu_job.c to validate command stream<br /> accesses against GEM buffer sizes. Arithmetic wraparound can therefore<br /> under-report region usage and bypass the bounds validation.<br /> <br /> Fix by validating signed additions, using overflow helpers for<br /> multiplications and offset updates, and propagating dma_length()<br /> failures to the caller.