Bug 2492734 (CVE-2026-53169) - CVE-2026-53169 kernel: accel/ethosu: reject NPU_OP_RESIZE commands from userspace
Summary: CVE-2026-53169 kernel: accel/ethosu: reject NPU_OP_RESIZE commands from users...
Keywords:
Status: NEW
Alias: CVE-2026-53169
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-25 10:02 UTC by OSIDB Bzimport
Modified: 2026-06-26 07:18 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-25 10:02:57 UTC
In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: reject NPU_OP_RESIZE commands from userspace

NPU_OP_RESIZE is a U85-only command that the driver does not yet
implement. The existing WARN_ON(1) placeholder fires unconditionally
whenever userspace submits this command via DRM_IOCTL_ETHOSU_GEM_CREATE,
causing unbounded kernel log spam.

If panic_on_warn is set the kernel panics, giving any unprivileged user
with access to the DRM device a trivial denial-of-service primitive.

Replace the WARN_ON(1) with an explicit -EINVAL return so the ioctl
rejects the command before it reaches hardware.


Note You need to log in before you can comment on or make changes to this bug.