An incorrect interpretation of bits 15:14 in the NPU_SET_{IFM,OFM}_PRECISION register caused the driver to read the U65 rounding mode field as a storage mode. This misreading caused every U65 command stream that requests natural or truncating rounding to fail at CMDSTREAM_BO_CREATE, returning -EINVAL. The failure propagates to memory size calculations, leading to bogus feature map sizes and resulting in dozens of errors in GPU workloads such as average pooling, concatenation, etc.

Any Linux kernel containing the ethosu driver before the patch commit 6b08adbda8ea797 shows this flaw. The issue is specific to the U65 hardware of the ARM Ethos-U family; U85 devices are unaffected because their register layout differs. Users running the i.MX93 platform or other SoCs that incorporate Ethos-U65 are impacted, as demonstrated by the Teflon test suite failure on i.MX93.

This vulnerability does not grant arbitrary code execution or privilege escalation. Its impact is a denial of service for applications that generate GPU command streams using natural or truncating rounding on U65 devices. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local or filesystem access to inject malformed command streams through Mesa or other graphics libraries; remote exploitation is unlikely without additional vulnerabilities. Therefore the risk is moderate, primarily affecting system availability for GPU workloads.