The flaw in the ethosu accelerator driver allows a userspace process to submit a job with an SRAM size of zero while still including SRAM accesses in the command stream. Because the driver skips setting the region base register when the requested size is zero, it reuses a stale base address from a previous job, causing the kernel to perform memory accesses at an unintended location. This results in memory corruption within the privileged kernel context and potentially leads to system failure or privilege escalation.

All Linux kernel builds that load and use the ethosu accelerated driver are affected. The issue resides entirely within the kernel source and is independent of distribution, so any distribution that ships with a kernel version before the patch is vulnerable.

Exploitation requires a local userspace process with the ability to submit jobs to the ethosu driver, typically root or a user with CAP_SYS_ADMIN. While the EPSS score is < 1% and the vulnerability is not yet listed in the CISA KEV catalog, the CVSS score of 7.8 indicates a significant risk of kernel memory corruption that could allow an attacker to achieve privilege escalation or deny service upon successful exploitation.