CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.
Описание
Оригинално описание
In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage from command stream values and updates region_size[]: len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset) Several arithmetic issues can corrupt the derived region size: - signed stride values may underflow when added to len - intermediate multiplications may overflow - len + dma->offset may overflow during region_size updates - dma_length() error returns were not validated by the caller region_size[] is later used by ethosu_job.c to validate command stream accesses against GEM buffer sizes. Arithmetic wraparound can therefore under-report region usage and bypass the bounds validation. Fix by validating signed additions, using overflow helpers for multiplications and offset updates, and propagating dma_length() failures to the caller.
Засегнати продукти
- Linux Linux: 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b преди 6bb73845d1855ceaf50e397175e5979a7bdf69bc; 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b преди ee6d9b6e51626f259c6f0e38d94f91be4fd14754
- Linux Linux: 6.19; преди 6.19; 7.0.13 до 7.0.*; от 7.1 нататък
История
- 25 юни 2026 Публикувано