A flaw in the Linux kernel’s Ethos‑U (NPU) driver allows a user to issue DMA start commands with an uninitialized length field. The driver uses a sentinel value of U64_MAX to mark missing length setup, but arithmetic on this sentinel can wrap to a small value, causing bounds checks to be bypassed. The hardware then executes a DMA transfer using stale physical addresses, enabling a kernel memory read or write that can be leveraged for privilege escalation.

All Linux kernel releases that include the Ethos‑U NPU driver and that have not yet been upgraded to the patched version are affected. The vulnerability is present in the default kernel configuration and is not limited to specific versions according to the available data.

The vulnerability can be exploited by a local user who can send NPU commands to the kernel. There is no EPSS score available, and the issue is not listed in the CISA KEV catalog, but the flaw provides direct kernel memory corruption, giving an attacker the potential for arbitrary code execution with elevated privileges. The attacker would need the ability to interact with the Ethos‑U driver, so a local or privilege‑escalated user is the likely entry point.