A command intended only for privileged operation—NPU_OP_RESIZE—is accepted by the Linux kernel’s Ethos‑U driver even though it is not implemented. The driver uses a placeholder that unconditionally triggers a WARN_ON(1), leading to unbounded kernel log messages. If the kernel is configured with panic_on_warn, this extra warning causes the kernel to panic. The result is a trivial denial‑of‑service capability for any user able to invoke the DRM ioctl that sends this command.

Linux kernel implementations that include the Accel/Ethos‑U driver. No specific vendor product or version notes are provided beyond the generic Linux kernel designation.

The vulnerability relies on a privileged device interface (DRM_IOCTL_ETHOSU_GEM_CREATE) that a non‑root user can access if authorized to interact with the DRM subsystem. The exploit is local and does not require elevated privileges. Although EPSS and CVSS metrics are not available, the kernel panic and widespread log flooding pose a measurable denial‑of‑service risk. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The attack vector is local user access to the DRM device and is trivial to achieve for anyone with that access.