A vulnerability in the Linux kernel Ethos-U driver allows a local attacker with low privileges to trigger memory corruption and achieve high-impact system compromise.

This is an input validation vulnerability within the Ethos-U accelerator driver (accel: ethosu). An authenticated local user can supply malformed command streams that cause the kernel to miscalculate buffer sizes, leading to out-of-bounds memory access.

The exploitation of this vulnerability can result in the full compromise of the affected system. Because the vulnerability exists within the kernel, a successful attack may lead to arbitrary code execution with kernel-level privileges, resulting in total data loss, system instability, or privilege escalation. The CVSS score of 7.8 confirms the high severity, reflecting the potential for complete loss of confidentiality, integrity, and availability.

Immediate Action: Apply the Linux kernel security update to version 7.1.6 or later, which contains the necessary fixes for the Ethos-U command stream validation logic.

Proactive Monitoring: Monitor system logs for kernel-related crashes or segmentation faults, particularly those originating from the Ethos-U driver, which may indicate attempted exploitation.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected hardware or the device files associated with the Ethos-U accelerator to only necessary users.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to systems utilizing Ethos-U hardware acceleration. Security teams should prioritize patching the kernel to the stable version 7.1.6 to eliminate the risk of local privilege escalation. Immediate remediation is necessary to prevent potential exploitation by malicious local actors.