HIGH Introduced in 6.19
ethosu SramMap Deref
CVE-2026-97912
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. The non-zero size allows jobs to access SRAM which is left pointing to physical base address 0x0.
02KernelScan AI Analysis
Risk summary
Systems with Arm Ethos-U NPU hardware where SRAM allocation fails during driver probe leave the SRAM size non-zero while the SRAM pointer is NULL. Any local user with access to submit jobs to the NPU can trigger DMA reads and writes to physical address 0x0, leading to kernel memory corruption, information disclosure, or denial of service.
Vulnerability analysis
When the Arm Ethos-U NPU driver fails to allocate SRAM memory during device probe, the SRAM size field is left non-zero even though the SRAM pointer is NULL. Because the driver treats SRAM as optional and does not abort probe on this failure, the device becomes operational with SRAM configured to point at physical address 0x0. Since the NPU is a DMA engine with no MMU or IOMMU, any submitted job that references the SRAM region causes the hardware to read or write physical address 0x0, corrupting kernel memory. The fix sets the SRAM size to zero when allocation fails, preventing jobs from using the invalid SRAM region. This vulnerability requires specific hardware (Arm Ethos-U NPU) and a local user with access to submit jobs to the accelerator device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.7 | e5576641b79e |
| mainline | 6.19 | 7.3-rc3 | f5376d7e0fb7 |