EUVD-2026-86768

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

CVE-2026-97914

In the Linux kernel , a vulnerability was identified in the ethosu accelerator component within the ethosu_job_open() function. The issue occurred because a WARN_ON() macro returned a 0 or 1 instead of the original negative error code (errno), potentially leading to incorrect error reporting to u...

CVE-2026-97914 accel: ethosu: Fix ethosu_job_open() return value

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

CVE-2026-97914 accel: ethosu: Fix ethosu_job_open() return value

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

CVE-2026-97912 accel: ethosu: Ensure SRAM size is 0 on mapping failure

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. T...

CVE-2026-97912

The Linux kernel contains a vulnerability in the ethosu accelerator driver where an SRAM mapping failure does not correctly reset the SRAM size to zero. Because the error return is not checked (as SRAM is not a hard requirement), the probe succeeds while leaving a non-zero size. This allows jobs ...

CVE-2026-97913

The Linux kernel contains a vulnerability in the accel: ethosu component. The issue arises because the QSIZE register setting might not guarantee a hardware interrupt to prevent a timeout during an out-of-bounds access of the command stream. To resolve this, the system now ensures that the comman...

EUVD-2026-86767

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is require...

EUVD-2026-86766

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. T...

CVE-2026-97913 accel: ethosu: Ensure cmd stream ends with a stop op

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is require...

CVE-2026-97911

The Linux kernel contains a vulnerability in the accel: ethosu driver where userspace can set a job's SRAM size to 0 while maintaining SRAM accesses in the command stream. Because the region base register is skipped when the size is 0, the system may use a stale base address from a previous job. ...

EUVD-2026-86765

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

EUVD-2026-86764

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

CVE-2026-97910

The Linux kernel contains a vulnerability in the ASoC: sprd driver where sprd_platform_compr_open() allocates fixed-size buffers (32K IRAM and 2M DDR) that are not properly validated against user-controlled inputs. Specifically, sprd_platform_compr_copy() derives copy lengths from runtime->fra...

CVE-2026-97911 accel: ethosu: Ensure SRAM region size matches job

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

CVE-2026-97910 ASoC: sprd: validate compress buffer sizes against fixed allocations

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

CVE-2026-97910 ASoC: sprd: validate compress buffer sizes against fixed allocations

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

CVE-2026-97911 accel: ethosu: Ensure SRAM region size matches job

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

EUVD-2026-86763

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

CVE-2026-97909

The Linux kernel contains a vulnerability in the ASoC (Android Simple Open Source Audio Configuration) component where the uni_reader_init() function registers a shared IRQ before initializing the reader->irq_lock. This race condition allows a pending interrupt to invoke the handler while the ...