All vulnerabilities
CVE-2026-98143

Linux: accel: ethosu: Don't read the U65 rounding mode as a storage mode

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6b08adbda8ea797849e3654ce12cb3856ce6051aFixed versionCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 6b08adbda8ea797849e3654ce12cb3856ce6051aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

accel: ethosu: Don't read the U65 rounding mode as a storage mode

Bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser has read it as a storage mode since the driver was added.

That went unnoticed while unknown values fell through the switch, but now that they are rejected, every U65 command stream that asks for natural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits it for average pooling, concatenation, split, unpack, strided slice, LUT and argmax, which is 72 failures of the Teflon test suite on an i.MX93. Truncating rounding (1) is misread as well: it picks the two-tile address path and computes a bogus feature map size from tile bases the command stream never set.

Read the field as a storage mode only on the hardware where it is one.

Text from CVE List

Affected versions 6

  • Linuxaffected: 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b before 6b08adbda8ea797849e3654ce12cb3856ce6051aCVE List
  • Linuxaffected: 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b before db9deec5a345abc538d081fb221dc0b00a9695bdCVE List
  • Linuxaffected: 6.19CVE List
  • Linuxunaffected: all versions before 6.19CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2