Bug 2513221 (CVE-2026-68316)

Summary: CVE-2026-68316 kernel: accel: ethosu: Fix element size accounting for cmd stream validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `accel: ethosu` component. This vulnerability involves incorrect element size accounting during command stream validation. Specifically, the calculation for element sizes of 16, 32, or 64 bits can be too small, and the element size is entirely missing for the NHWC format. Additionally, the bitfield for element size differs between Input Feature Map (IFM)/IFM2 and Output Feature Map (OFM) parameters. This could lead to improper handling of data within the command stream.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:25:37 UTC 
In the Linux kernel, the following vulnerability has been resolved:

accel: ethosu: Fix element size accounting for cmd stream validation

There are 2 issues with the element size handling in the command stream
validation which result in too small of a size calculated when the
element size is 16/32/64 bits.

For NHWC format, the element size is simply missing from the
calculation.

The bitfield for the element size is different between IFM/IFM2 and
OFM. IFM and IFM2 encode the precision in parameter bits 2:3, while OFM
uses bits 1:2.