In the Linux kernel, the Ethosu acceleration subsystem contains a flaw that can cause the command stream processed by the hardware to lack a mandatory stop operation. The QSIZE register was intended to limit the stream, but if the hardware does not raise an interrupt when the stream exceeds its bounds, the stream can overrun into invalid memory. An absent stop operation could cause the hardware to execute garbage instructions, which may corrupt kernel state and trigger a crash. This results in a denial of service via a kernel panic. The weakness is identified as CWE-166.

The flaw affects any Linux kernel that includes the Ethosu acceleration module, regardless of vendor, as the complaint refers to the generic Linux kernel code path. The advisory does not specify particular releases, so all kernels that have not yet applied the provided patch are potentially vulnerable. Systems that ship with a kernel build containing the legacy ethosu.c implementation are at risk.

The CVSS score for the vulnerability is 5.5, which places it in the moderate range, and the EPSS score is reported as < 1%, indicating a very low probability of exploitation. The issue is not listed in the CISA KEV catalog, which means no publicly known exploitation has been documented. Because the flaw affects an internal kernel driver used only by privileged code, the attack vector is likely local or requires privileged kernel interaction; this is inferred from the nature of kernel device drivers. Consequently the risk of active exploitation remains low, although a kernel crash would result in a denial of service.