7.8

CVE-2026-53172: linux Out-of-bounds Read

CVSS: 7.8v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-53172DEBIAN-CVE-2026-53172
Published 25-06-2026Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2026-53172 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.7% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.12%
0%100%
Low · -0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 11
USN-8726-1USN-8726-2USN-8726-3USN-8726-4USN-8727-1USN-8728-1

Timeline

  1. 25-06-2026
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REGION extracts the region index with param & 0x7f, giving a maximum value of 127. However region_size[] and output_region[] in struct ethosu_validated_cmdstream_info are both sized to NPU_BASEP_REGION_MAX (8), giving valid indices [0..7]. Every other region assignment in the same switch uses param & 0x7: NPU_SET_OFM_REGION: st.ofm.region = param & 0x7; NPU_SET_IFM2_REGION: st.ifm2.region = param & 0x7; NPU_SET_WEIGHT_REGION: st.weight[0].region = param & 0x7; NPU_SET_SCALE_REGION: st.scale[0].region = param & 0x7; The 0x7f mask on IFM is inconsistent and appears to be a typo. feat_matrix_length() and calc_sizes() use the region index directly as an array subscript into the kzalloc'd info struct: info->region_size[fm->region] = max(...); A userspace caller supplying NPU_SET_IFM_REGION with param > 7 causes a write up to 127*8 = 1016 bytes past the start of region_size[], corrupting adjacent kernel heap data. Fix by applying the same & 0x7 mask used by all other region assignments.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.12%

Chance of exploitation in the next 30 days

Percentile

2%

Versus all other CVEs

30-day change

-0.05 pp

From 0.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.12%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu110 products
  • linux< 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b, < ee7bed779def61ebff1b92b0e851f412176fa416 | ≥ 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b, < 00f547e0dfecf83014fb32bcba587c6b684c1362 | 6.19
  • linux_kernel≥ 6.19, < 7.0.13 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5 | 7.1:rc6
Debian1 product
  • linux< 7.0.13-1

3 vendors · 113 products

References

17 links
Show all 17 references