CVE-2026-53170: Linux Kernel Ethos-U NPU Local Privilege Escalation

Technical summary

The accel/ethosu driver uses memset(0xff) to initialize command state, setting dma->len to U64_MAX as a sentinel for 'uninitialized.' The NPU_SET_DMA0_LEN command is the only legitimate setter. If userspace submits NPU_OP_DMA_START without first issuing NPU_SET_DMA0_LEN, dma->len remains U64_MAX. In the dma_length() function, adding a positive stride to U64_MAX causes integer wraparound, yielding a small value. When size0 equals 1, check_mul_overflow() does not catch the overflow, and dma_length() returns 0 instead of U64_MAX. The caller's validation check for U64_MAX then incorrectly passes, region_size[] remains 0, and the memory bounds check in ethosu_job.c is circumvented. The fix adds an explicit U64_MAX check before arithmetic operations in dma_length().

Business impact

This vulnerability permits local privilege escalation on systems running vulnerable Linux kernels with Ethos-U NPU hardware. An attacker with local user access can corrupt kernel memory, potentially gaining root privileges, reading sensitive data, or causing denial of service. Organizations deploying Arm-based AI accelerators in multi-tenant or untrusted environments face elevated risk of container escape, lateral movement, or data exfiltration.

Affected systems

Linux kernel versions with the accel/ethosu driver. Vulnerability requires local access and affects systems where unprivileged users can submit NPU commands. Arm Ethos-U accelerators used in AI inference appliances, edge compute platforms, and certain mobile or embedded deployments are in scope. Consult vendor security advisories and your kernel version against the Linux kernel security database to determine precise affected versions.

Exploitability

Exploitability is moderate to high. The attack requires local user-level access (PR:L) and no user interaction (UI:N), making it practical for multi-user systems or container escape scenarios. No network access is needed (AV:L). The vulnerability does not appear in active exploitation databases; however, the attack surface is straightforward: send an incomplete command sequence to the NPU driver. Complexity is low (AC:L) because no race conditions or special timing are needed.

Remediation

Apply the Linux kernel patch that adds U64_MAX validation at the start of dma_length() before any arithmetic. Verify the patch against the official Linux kernel security advisories and your vendor's release notes. Alternatively, if kernel patching is delayed, restrict unprivileged user access to NPU device nodes via SELinux, AppArmor, or device permissions until a patched kernel is deployed.

Patch guidance

Update the Linux kernel to a version that includes the fix for CVE-2026-53170. Consult your Linux distribution (Red Hat, Ubuntu, Debian, etc.) for the specific kernel version or backport. Verify the patch in the accel/ethosu driver's dma_length() function explicitly checks for U64_MAX before performing arithmetic. Test in a non-production environment before rollout.

Detection guidance

Monitor kernel logs for unusual ethosu driver activity or DMA-related errors. Audit access to /dev/ethosu* or similar NPU device nodes. Host-based intrusion detection systems (HIDS) can flag suspicious memory access patterns or privilege escalation attempts originating from NPU command sequences. Verify kernel version and compare against patched releases from your vendor. Review user and container isolation policies to limit who can interact with NPU hardware.

Why prioritize this

CVSS 8.8 HIGH severity with local privilege escalation (C:H, I:H, A:H) warrants prompt remediation. The scope impact (S:C) means a compromise affects the entire system beyond the driver's context. Although not yet widely exploited in the wild (KEV status: false), the low complexity and absence of special privileges make this a prime target once public. Prioritize systems in multi-tenant or edge-compute roles.

Risk score, explained

The 8.8 CVSS reflects high severity: a local attacker gains full system confidentiality, integrity, and availability impact. Low attack complexity (AC:L) and local-only requirement (AV:L) with low privileges (PR:L) mean minimal barriers to exploitation. The scope change from the driver context to system-wide impact elevates risk. Absence from KEV does not diminish urgency; this is a textbook privilege-escalation path in shared environments.

Frequently asked questions