CVE-2026-53172

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> accel/ethosu: fix IFM region index out-of-bounds in command stream parser<br /> <br /> NPU_SET_IFM_REGION extracts the region index with param &amp; 0x7f, giving<br /> a maximum value of 127. However region_size[] and output_region[] in<br /> struct ethosu_validated_cmdstream_info are both sized to<br /> NPU_BASEP_REGION_MAX (8), giving valid indices [0..7].<br /> <br /> Every other region assignment in the same switch uses param &amp; 0x7:<br /> NPU_SET_OFM_REGION: st.ofm.region = param &amp; 0x7;<br /> NPU_SET_IFM2_REGION: st.ifm2.region = param &amp; 0x7;<br /> NPU_SET_WEIGHT_REGION: st.weight[0].region = param &amp; 0x7;<br /> NPU_SET_SCALE_REGION: st.scale[0].region = param &amp; 0x7;<br /> <br /> The 0x7f mask on IFM is inconsistent and appears to be a typo.<br /> <br /> feat_matrix_length() and calc_sizes() use the region index directly<br /> as an array subscript into the kzalloc&amp;#39;d info struct:<br /> info-&gt;region_size[fm-&gt;region] = max(...);<br /> <br /> A userspace caller supplying NPU_SET_IFM_REGION with param &gt; 7 causes<br /> a write up to 127*8 = 1016 bytes past the start of region_size[],<br /> corrupting adjacent kernel heap data.<br /> <br /> Fix by applying the same &amp; 0x7 mask used by all other region<br /> assignments.