{
  "cveId": "CVE-2026-53170",
  "url": "https://patchblox.com/security/cve/CVE-2026-53170",
  "summary": "CVE-2026-53170 is fixed in linux on 1 platform by DEBIAN-CVE-2026-53170 (version 7.0.13-1), released June 28, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  accel/ethosu: reject DMA commands with uninitial...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  accel/ethosu: reject DMA commands with uninitialized length  cmd_state_init() initializes the command state with memset(0xff), leaving dma-\u003Elen at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma-\u003Elen remains U64_MAX.  In dma_length(), a positive stride added to U64_MAX wraps to a small value. With size0 == 1, check_mul_overflow() does not trigger and dma_length() returns 0 instead of U64_MAX. The caller\u0027s U64_MAX check then passes, region_size[] stays 0, and the bounds check in ethosu_job.c is bypassed, allowing hardware to execute DMA with stale physical addresses.  Fix by checking for U64_MAX at the start of dma_length() before any arithmetic, consistent with the sentinel value used throughout the driver to detect uninitialized fields.",
  "published": "2026-06-25T09:16:34Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00175,
  "epssPercentile": 0.07056,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.0.13-1",
      "fix": "DEBIAN-CVE-2026-53170",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-53170",
      "released": "2026-06-28T17:47:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}