{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\naccel\/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()\\n\\nThe command stream parsing loop increments the index variable a second\\ntime when a 64-bit command word is encountered (bit 14 set), but does\\nnot re-check the loop bound before writing the second word:\\n\\n for (i = 0; i \\u003c size \/ 4; i++) {\\n bocmds[i] = cmds[0];\\n if (cmd \\u0026 0x4000) {\\n i++;\\n bocmds[i] = cmds[1]; \/* unchecked *\/\\n }\\n }\\n\\nThe buffer bocmds is backed by a DMA allocation of exactly size bytes\\nfrom drm_gem_dma_create(ddev, size), giving valid indices [0, size\/4-1].\\n\\nWhen i == size\/4 – 1 on entry to an iteration and bit 14 of cmds[0] is\\nset, bocmds[size\/4-1] is written in bounds, i is then incremented to\\nsize\/4, and bocmds[size\/4] writes four bytes past the end of the\\nallocation.\\n\\nUserspace controls both the buffer contents and the size argument via\\nthe ioctl, making this a userspace-triggerable heap out-of-bounds write.\\n\\nFix by checking the incremented index against the buffer bound before\\nthe second write and returning -EINVAL if the buffer is too small to\\ncontain the extended command.”,”published”:”2026-06-25T08:38:50.709Z”,”modified”:”2026-06-28T06:39:46.702Z”,”type”:”cve”,”title”:”accel\/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/db6cb3e35cebf487f9a78ebd4cfa4b83708ff40d\\nhttps:\/\/git.kernel.org\/stable\/c\/c0837b9cf6eabbad8b8cbddaff1a46a6d0a2e29d”,”id”:”CVE-2026-53173″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b\\nLinux Linux 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b\\nLinux Linux 6.19″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\naccel\/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()\\n\\nThe command stream parsing loop increments the index variable a second\\ntime…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-66478","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n