EUVD-2026-55433

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix potential use-after-free in airohappedeinit airohappedeinit replaces the NPU pointer with NULL via rcureplacepointer but does not wait for existing RCU readers to exit before calling ppedeinit and airohanpuput...

CVE-2026-68332 net: airoha: Fix potential use-after-free in airoha_ppe_deinit()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix potential use-after-free in airohappedeinit airohappedeinit replaces the NPU pointer with NULL via rcureplacepointer but does not wait for existing RCU readers to exit before calling ppedeinit and airohanpuput...

CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

EUVD-2026-55431

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

USN-8618-1: Linux kernel vulnerabilities

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. CVE-2025-54518 Several security issues...

CVE-2026-53169

A flaw was found in the Linux kernel's accel/ethosu driver. An unprivileged local user with access to the Direct Rendering Manager DRM device could submit a specific command NPUOPRESIZE that the driver does not properly handle. This could lead to excessive kernel log spam and, if the paniconwarn...

UBUNTU-CVE-2026-53169

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject NPUOPRESIZE commands from userspace NPUOPRESIZE is a U85-only command that the driver does not yet implement. The existing WARNON1 placeholder fires unconditionally whenever userspace submits this command via...

CVE-2026-53169

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject NPUOPRESIZE commands from userspace NPUOPRESIZE is a U85-only command that the driver does not yet implement. The existing WARNON1 placeholder fires unconditionally whenever userspace submits this command via...

CVE-2026-53169

In the Linux kernel, accel/ethosu has been fixed to reject NPU_OP_RESIZE commands from userspace. The driver previously used an unconditional WARN_ON(1) in DRM_IOCTL_ETHOSU_GEM_CREATE, enabling kernel log spam and, if panic_on_warn was set, potential DoS via a local unprivileged user. The patch r...

EUVD-2026-39260

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject NPUOPRESIZE commands from userspace NPUOPRESIZE is a U85-only command that the driver does not yet implement. The existing WARNON1 placeholder fires unconditionally whenever userspace submits this command via...

EUVD-2026-39261

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmdstateinit initializes the command state with memset0xff, leaving dma-len at U64MAX to signal missing setup. The only setter is NPUSETDMA0LEN; if userspace omits this...

CVE-2026-53169 accel/ethosu: reject NPU_OP_RESIZE commands from userspace

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject NPUOPRESIZE commands from userspace NPUOPRESIZE is a U85-only command that the driver does not yet implement. The existing WARNON1 placeholder fires unconditionally whenever userspace submits this command via...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fixed a potential use-after-free issue in airohanpuget. np-name was being used after calling ofnodeputnp, which releases the node and could lead to a use-after-free bug. Previously, ofnodeputnp was called...

CVE-2026-20718

A flaw was found in IntelR NPU Driver software installers. Incorrect default permissions may allow an unprivileged, authenticated local attacker to escalate privileges. This high-complexity attack requires user interaction and can lead to significant impacts on the confidentiality, integrity, and...

CVE-2026-20754

CVE-2026-20754 pertains to improper conditions checks in firmware for Intel NPU Driver components (Ring 1: Device Drivers). The issue arises from a faulty condition check that can permit a local, low-complexity attack by an authenticated, unprivileged user, potentially enabling a denial of servic...

CVE-2026-20754

Improper conditions check in some firmware for some IntelR NPU Drivers within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via...

CVE-2026-20718

Incorrect default permissions for some IntelR NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation ...

CVE-2026-20718

Incorrect default permissions for some IntelR NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation ...

PT-2026-40084

Incorrect default permissions for some IntelR NPU Driver software installers before version 32.0.100.4511 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation ...