accel: ethosu: Don't read the U65 rounding mode as a storage mode (CVE-2026-98143) | HOL Guard CVE

High · CVSS 7.8CVE-2026-98143

accel: ethosu: Don't read the U65 rounding mode as a storage mode

Answer in brief

CVE-2026-98143 records a High severity (CVSS 7.8) vulnerability in accel: ethosu: Don't read the U65 rounding mode as a storage mode. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.8
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b <6b08adbda8ea797849e3654ce12cb3856ce6051a \|\| >=5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b <db9deec5a345abc538d081fb221dc0b00a9695bd	6b08adbda8ea797849e3654ce12cb3856ce6051a, db9deec5a345abc538d081fb221dc0b00a9695bd
Linux/Linuxgeneric	6.19	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 6b08adbda8ea797849e3654ce12cb3856ce6051a if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser has read it as a storage mode since the driver was added. That went unnoticed while unknown values fell through the switch, but now that they are rejected, every U65 command stream that asks for natural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits it for average pooling, concatenation, split, unpack, strided slice, LUT and argmax, which is 72 failures of the Teflon test suite on an i.MX93. Truncating rounding (1) is misread as well: it picks the two-tile address path and computes a bogus feature map size from tile bases the command stream never set. Read the field as a storage mode only on the hardware where it is one.

Quoted source text, attributed separately from HOL analysis.