The flaw is in the Linux kernel’s accel/ethosu driver, where the dma_length() function calculates DMA region sizes from command‑stream parameters using arithmetic that can underflow, overflow, or neglect the DMA offset. Because these errors leave the region_size array understated, subsequent bounds checks in ethosu_job.c can be bypassed, allowing a supplied command stream to read or write beyond the intended buffer. The vulnerability exposes a classic integer overflow (CWE‑190) that can lead to memory corruption, crashes or arbitrary code execution within kernel context.

Any Linux kernel installation that includes the accel/ethosu driver and contains the arithmetic bug is vulnerable. The patch was added in the upstream kernel after the idiosyncratic commits referenced, but version ranges are not explicitly documented – users should ensure their kernel build reflects the fixed code.

EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, so public exploitation risk is uncertain. The defect lies in kernel code, implying that an attacker would need local or privileged access to supply a malicious command stream to the driver. If successfully triggered, the corrupted bounds checks could lead to kernel memory corruption, potentially compromising system integrity or granting elevated privileges. The severity is high because kernel memory corruption is a critical failure point, even though a CVSS score is not provided.