CVE-2026-68316

Received Received - Intake

Element Size Miscalculation in Linux Kernel Ethosu Accelerator

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is 16/32/64 bits. For NHWC format, the element size is simply missing from the calculation. The bitfield for the element size is different between IFM/IFM2 and OFM. IFM and IFM2 encode the precision in parameter bits 2:3, while OFM uses bits 1:2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68316

EUVD

EUVD-2026-55417

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect element size accounting during command stream validation in the ethosu accelerator. It affects calculations when element sizes are 16/32/64 bits, particularly missing element size for NHWC format. The issue stems from differing bitfield encodings for element size between IFM/IFM2 and OFM.

Detection Guidance

This vulnerability is specific to the Linux kernel's ethosu accelerator and cannot be detected via network scans or standard system commands. It requires kernel-level inspection of the ethosu driver and command stream validation logic. Check kernel logs for ethosu-related errors or examine the driver source code for the described element size handling issues.

Impact Analysis

This vulnerability could lead to incorrect memory handling or buffer overflows in systems using the ethosu accelerator. If exploited, it may cause system instability, crashes, or potential privilege escalation in affected Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue related to element size handling in the Ethosu accelerator, which does not involve data privacy, security controls, or regulatory compliance requirements.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the element size accounting issue in the ethosu accelerator command stream validation.

Hi! I’m here to help you understand CVE-2026-68316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70