The vulnerability stems from the airoha network driver mapping mailbox buffers only for DMA_TO_DEVICE, which fails to invalidate the CPU cache on non‑cache‑coherent architectures. This issue is a form of erroneous input handling, identified as CWE‑367. When the NPU writes response data back into the same buffer, the processor may read stale contents, producing silent corruption of driver data and potentially incorrect network driver operation.

This flaw affects the Linux kernel’s airoha network driver on platforms that lack cache coherency between the CPU and the NPU, such as the EN7581 Cortex‑A53 board. All kernel versions containing the affected driver code without the patch are susceptible; the issue is resolved in any release that incorporates the commit that changes the mapping to DMA_BIDIRECTIONAL.

The CVSS score of 7.8 signals moderate severity, but the EPSS score of < 1% indicates a very low yet non‑zero chance of exploitation. The vulnerability is currently not listed in the CISA KEV catalog and no public exploits are documented. It is inferred that an attacker could trigger corrupted reads by sending specially crafted packets that invoke the NPU mailbox operations, though such an attack path is not proven. The risk primarily concerns data integrity and the reliability of network driver functions rather than remote code execution.