HIGH Introduced in 6.19
ethosu DoneFence UAF
CVE-2026-89976
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix job completion fence cleanup ethosu_ioctl_submit_job() allocates done_fence before validating buffer handles. Errors after allocation call ethosu_job_err_cleanup(), which frees the job but leaks the uninitialized fence. A scheduler dependency error also lets ethosu_job_run() return before dma_fence_init(). Normal cleanup then passes a zeroed refcount to dma_fence_put(). Release done_fence in the common cleanup path and use dma_fence_was_initialized() to distinguish initialized fences from raw allocations. [robh: also fix goto]
02KernelScan AI Analysis
Risk summary
A local user with access to the Arm Ethos-U NPU DRM device can trigger a use-after-free via the job submission ioctl. Error paths after fence allocation but before fence initialization can cause a fence release function to operate on a zeroed reference count, leading to memory corruption. This requires the Ethos-U NPU driver to be loaded and the device node to be accessible.
Vulnerability analysis
The Arm Ethos-U NPU driver allocates a completion fence during job submission before validating the caller's buffer handles. When validation fails, the error cleanup frees the job structure but never releases the fence, leaking memory. More seriously, a scheduler dependency error can cause the job's execution function to return before the fence has been initialized, so the normal teardown path calls a fence release function on a raw allocation whose reference count is still zero. This can trigger a double-free or use-after-free in kernel memory. The patch moves fence cleanup into the shared error-handling path and checks whether the fence was actually initialized before releasing it, ensuring raw allocations are freed directly while initialized fences go through the normal reference-count path. The vulnerable ioctl is reachable locally by any user who can open the NPU's DRM device node; no special kernel privileges are required beyond device file access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.19 | 7.3-rc2 | 2d2a3adc9195 |
| 7.2 | 6.19 | 7.2.5 | b3e0f79af1f2 |