CVE-2026-53172: Linux Kernel NPU Buffer Overflow – High Severity Privilege Escalation Risk

Technical summary

CVE-2026-53172 is a heap buffer out-of-bounds write vulnerability in the accel/ethosu subsystem of the Linux kernel. The NPU_SET_IFM_REGION command handler extracts a region index using (param & 0x7f), yielding indices 0–127. However, the region_size[] and output_region[] arrays in struct ethosu_validated_cmdstream_info are sized to NPU_BASEP_REGION_MAX (8 elements), supporting only indices 0–7. Every other region assignment in the same switch statement correctly uses (param & 0x7), indicating the 0x7f mask is a typo. When feat_matrix_length() or calc_sizes() use this unchecked index as an array subscript, an out-of-bounds write up to 1016 bytes past region_size[] corrupts adjacent kernel heap metadata and data structures.

Business impact

This vulnerability allows any unprivileged local user with access to the NPU device to crash the kernel, leak sensitive kernel memory, or potentially escalate privileges. Systems relying on NPU hardware acceleration (increasingly common in edge AI applications, automotive platforms, and embedded systems) face elevated risk of denial of service or privilege escalation attacks. Organizations deploying Arm-based edge or IoT infrastructure should assess exposure and prioritize patching.

Affected systems

The Linux kernel accel/ethosu driver is affected. This impacts systems with Arm Ethos-U NPU hardware or software emulation support enabled. Typically found in edge computing platforms, automotive SoCs, embedded Linux deployments, and AI inference appliances. Desktop and server deployments with this subsystem built-in or as a module are also at risk if the NPU device is accessible to unprivileged users.

Exploitability

Exploitability is moderate to high. The attack requires local access and the ability to interact with the NPU device (e.g., /dev/ethosu or equivalent), which may be restricted by file permissions or SELinux policy. However, once access is obtained, no special privileges or user interaction is required; a malicious process can immediately craft and submit the malformed command. The vulnerability is straightforward to trigger and does not require specialized knowledge of the NPU instruction set—only crafting a single command with an out-of-range region index.

Remediation

Apply the upstream Linux kernel patch that corrects the NPU_SET_IFM_REGION mask from (param & 0x7f) to (param & 0x7), aligning it with other region assignment operations. Verify the patch against the official Linux kernel repository or your distribution's security advisory. Alternatively, disable the accel/ethosu driver if NPU acceleration is not required.

Patch guidance

Locate and apply the kernel patch from the Linux kernel repository that fixes the mask in the accel/ethosu command stream parser. Check your Linux distribution's security advisories for backported fixes to stable kernels you are running. If you maintain a custom kernel, manually apply the one-line change to switch the mask constant from 0x7f to 0x7. Recompile and reboot. Verify the fix by confirming the corrected mask is present in the running kernel image.

Detection guidance

Monitor for unexpected kernel crashes, particularly on systems with NPU drivers loaded. Enable kernel address space layout randomization (ASLR) and heap corruption detection (if available) to surface exploitation attempts. Audit device permissions for /dev/ethosu or equivalent; restrict access to trusted users. Consider kernel hardening options such as CONFIG_HARDENED_USERCOPY and CONFIG_DEBUG_LIST. System call tracing (auditd, strace) can identify processes attempting to interact with the NPU device or command stream parser, but will not definitively prove exploitation attempt without additional heap instrumentation.

Why prioritize this

This vulnerability merits HIGH priority because it permits local privilege escalation and denial of service with minimal user interaction. It affects a growing category of edge AI and embedded systems. The fix is simple and low-risk, making rapid patching feasible. Until patched, restrict NPU device access via filesystem permissions or disable the subsystem if not in use.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vulnerability permits arbitrary kernel memory corruption, justifying the high severity despite requiring local access.

Frequently asked questions