GHSA-R4M4-4FFX-QG5J
Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-14 00:31In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Fix DMA direction for NPU mailbox buffer
airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer:
- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into the buffer, then the caller reads it via memcpy()
- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back npu_stats_addr field in the response
On non-cache-coherent architectures like EN7581 (Cortex-A53 without hardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op — it does not invalidate the CPU cache. If the NPU-written cache line is still present in the CPU cache when the caller reads the buffer, the CPU observes stale data instead of the NPU response.
This is a timing-sensitive bug: small mailbox buffers (~24 bytes) typically fit in a single cache line and may survive in the cache until the caller reads them, producing silent data corruption rather than a crash. The bug is more likely to trigger when the caller reads the response immediately after dma_unmap_single() without intervening cache-evicting operations.
Fix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures dma_unmap_single() invalidates the CPU cache on non-coherent systems. The mailbox buffers are small so there is no performance concern.
{
"affected": [],
"aliases": [
"CVE-2026-68330"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T13:20:23Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix DMA direction for NPU mailbox buffer\n\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\n the buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\n npu_stats_addr field in the response\n\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n\u2014 it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\n\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\n\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern.",
"id": "GHSA-r4m4-4ffx-qg5j",
"modified": "2026-08-14T00:31:55Z",
"published": "2026-08-10T15:33:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68330"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.