CVE-2026-53172

In the Linux kernel, the following vulnerability has been resolved:

accel/ethosu: fix IFM region index out-of-bounds in command stream parser

NPUSETIFMREGION extracts the region index with param & 0x7f, giving a maximum value of 127. However regionsize[] and outputregion[] in struct ethosuvalidatedcmdstreaminfo are both sized to NPUBASEPREGION_MAX (8), giving valid indices [0..7].

Every other region assignment in the same switch uses param & 0x7: NPUSETOFMREGION: st.ofm.region = param & 0x7; NPUSETIFM2REGION: st.ifm2.region = param & 0x7; NPUSETWEIGHTREGION: st.weight[0].region = param & 0x7; NPUSETSCALEREGION: st.scale[0].region = param & 0x7;

The 0x7f mask on IFM is inconsistent and appears to be a typo.

featmatrixlength() and calcsizes() use the region index directly as an array subscript into the kzalloc'd info struct: info->regionsize[fm->region] = max(...);

A userspace caller supplying NPUSETIFMREGION with param > 7 causes a write up to 127*8 = 1016 bytes past the start of regionsize[], corrupting adjacent kernel heap data.

Fix by applying the same & 0x7 mask used by all other region assignments.