Vulnerability-Lookup

GHSA-M67F-86JG-MHM5

Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

accel: ethosu: Don't read the U65 rounding mode as a storage mode

Bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser has read it as a storage mode since the driver was added.

That went unnoticed while unknown values fell through the switch, but now that they are rejected, every U65 command stream that asks for natural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits it for average pooling, concatenation, split, unpack, strided slice, LUT and argmax, which is 72 failures of the Teflon test suite on an i.MX93. Truncating rounding (1) is misread as well: it picks the two-tile address path and computes a bogus feature map size from tile bases the command stream never set.

Read the field as a storage mode only on the hardware where it is one.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98143"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T11:17:45Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Don\u0027t read the U65 rounding mode as a storage mode\n\nBits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage\nmode on U85 only. On U65 the same field holds the rounding mode, and the\ncommand stream parser has read it as a storage mode since the driver was\nadded.\n\nThat went unnoticed while unknown values fell through the switch, but\nnow that they are rejected, every U65 command stream that asks for\nnatural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits\nit for average pooling, concatenation, split, unpack, strided slice, LUT\nand argmax, which is 72 failures of the Teflon test suite on an i.MX93.\nTruncating rounding (1) is misread as well: it picks the two-tile\naddress path and computes a bogus feature map size from tile bases the\ncommand stream never set.\n\nRead the field as a storage mode only on the hardware where it is one.",
  "id": "GHSA-m67f-86jg-mhm5",
  "modified": "2026-09-25T15:31:45Z",
  "published": "2026-09-25T12:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98143"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6b08adbda8ea797849e3654ce12cb3856ce6051a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db9deec5a345abc538d081fb221dc0b00a9695bd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-98143 (GCVE-0-2026-98143)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 14:42

Title

accel: ethosu: Don't read the U65 rounding mode as a storage mode

Summary

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser has read it as a storage mode since the driver was added. That went unnoticed while unknown values fell through the switch, but now that they are rejected, every U65 command stream that asks for natural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits it for average pooling, concatenation, split, unpack, strided slice, LUT and argmax, which is 72 failures of the Teflon test suite on an i.MX93. Truncating rounding (1) is misread as well: it picks the two-tile address path and computes a bogus feature map size from tile bases the command stream never set. Read the field as a storage mode only on the hardware where it is one.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/6b08adbda8ea79784…
https://git.kernel.org/stable/c/db9deec5a345abc53…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b , < 6b08adbda8ea797849e3654ce12cb3856ce6051a (git) Affected: 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b , < db9deec5a345abc538d081fb221dc0b00a9695bd (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ethosu/ethosu_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b08adbda8ea797849e3654ce12cb3856ce6051a",
              "status": "affected",
              "version": "5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b",
              "versionType": "git"
            },
            {
              "lessThan": "db9deec5a345abc538d081fb221dc0b00a9695bd",
              "status": "affected",
              "version": "5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ethosu/ethosu_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Don\u0027t read the U65 rounding mode as a storage mode\n\nBits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage\nmode on U85 only. On U65 the same field holds the rounding mode, and the\ncommand stream parser has read it as a storage mode since the driver was\nadded.\n\nThat went unnoticed while unknown values fell through the switch, but\nnow that they are rejected, every U65 command stream that asks for\nnatural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits\nit for average pooling, concatenation, split, unpack, strided slice, LUT\nand argmax, which is 72 failures of the Teflon test suite on an i.MX93.\nTruncating rounding (1) is misread as well: it picks the two-tile\naddress path and computes a bogus feature map size from tile bases the\ncommand stream never set.\n\nRead the field as a storage mode only on the hardware where it is one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed data is an NPU command stream a local process passes through DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE on /dev/accel/accelN, which is validated by ethosu_gem_cmdstream_copy_and_validate() -\u003e calc_sizes() -\u003e feat_matrix_length(), then run via DRM_IOCTL_ETHOSU_SUBMIT. No network or radio transport carries it.\nAC:L - The attacker writes the whole command stream: rounding bits 15:14 = 1 in NPU_SET_OFM_PRECISION, x past WIDTH0_M1, and an arbitrary NPU_SET_OFM_BASE1. The validator then checks only base[0] while the U65 hardware uses base[1]. The result is deterministic and needs no race.\nPR:L - The ethosu ioctls CMDSTREAM_BO_CREATE and SUBMIT are registered with flags 0, with no DRM_ROOT_ONLY or capability check. Only permission to open the accel node is needed, which an ordinary user in the render/video group on a U65 board (e.g. i.MX93) holds.\nUI:N - The attacker\u0027s own process builds and submits the command stream. No other user has to do anything.\nS:U - The broken check is the kernel\u0027s own command-stream validator, and the NPU DMA it lets through corrupts the host kernel\u0027s own memory. That is the same security authority, i.e. a normal local privilege escalation, not a guest or sandbox escape.\nC:H - With rounding mode 1 on U65, feat_matrix_length() uses the storage-1 tile path and never bounds IFM/IFM2 base[1]/base[3]. The NPU can therefore DMA-read memory past the region BO at an offset the attacker chooses, and the result comes back through the attacker\u0027s mmapped OFM BO.\nI:H - The same mismatch on NPU_SET_OFM_PRECISION leaves OFM base[1]/base[3] unchecked, so region_size[] understates what the hardware writes. The ethosu_job.c region_size \u003e gem-\u003esize check passes while the NPU writes attacker-computed output outside the BO, into kernel memory.\nA:H - Uncontrolled NPU DMA writes outside the BO can corrupt kernel data and panic the system. On unaffected command streams, the misread also makes every Mesa U65 job with natural rounding fail with -EINVAL."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:42:11.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b08adbda8ea797849e3654ce12cb3856ce6051a"
        },
        {
          "url": "https://git.kernel.org/stable/c/db9deec5a345abc538d081fb221dc0b00a9695bd"
        }
      ],
      "title": "accel: ethosu: Don\u0027t read the U65 rounding mode as a storage mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98143",
    "datePublished": "2026-09-25T10:36:18.470Z",
    "dateReserved": "2026-09-25T10:25:14.319Z",
    "dateUpdated": "2026-09-25T14:42:11.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-M67F-86JG-MHM5

CVE-2026-98143 (GCVE-0-2026-98143)

Tags

Sightings

Nomenclature

Related by attack behaviour