CVE-2026-53169

What it actually does

This is a local denial-of-service vulnerability in the Linux kernel Arm Ethos-U accelerator DRM driver. The driver accepted an unsupported U85-only NPU_OP_RESIZE command through DRM_IOCTL_ETHOSU_GEM_CREATE and hit an unconditional WARN_ON(1) placeholder instead of rejecting the request. A local user with access to the Ethos-U DRM device can repeatedly trigger kernel warnings, causing unbounded kernel log spam. On systems where kernel.panic_on_warn is enabled, the same action can immediately panic the kernel and crash the host. The fix changes the behavior to return -EINVAL before the unsupported command reaches the warning path or hardware handling logic.

Why it matters to the business

An affected system can be crashed or degraded by a local user or compromised process that has access to the Ethos-U DRM device. In operational terms, this can interrupt workloads relying on the affected Linux host, embedded appliance, edge AI device, or NPU-enabled platform. If panic-on-warn is enabled for hardening or debugging, impact is more severe because exploitation can cause an immediate reboot or outage. If panic-on-warn is not enabled, repeated triggering may still create excessive kernel logs, consume storage or logging pipeline capacity, obscure other security events, and degrade system reliability. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported exploit maturity, so broad internet-driven exploitation is unlikely; the primary risk is local misuse after account compromise or by untrusted local workloads.

How an attack unfolds

An attacker first needs local code execution on a Linux system that includes the affected Ethos-U accelerator driver and exposes the relevant DRM device to the attacker, container, application, or user session. The attacker opens the DRM device node associated with the Ethos-U driver and submits a crafted DRM_IOCTL_ETHOSU_GEM_CREATE ioctl containing the unsupported NPU_OP_RESIZE operation. In vulnerable kernels, the driver reaches an unconditional WARN_ON(1). If kernel.panic_on_warn is set, the warning is escalated into a kernel panic, causing the system to crash or reboot. If panic_on_warn is not set, the attacker can loop the ioctl to generate large volumes of kernel warning messages, potentially filling logs, stressing logging infrastructure, and degrading observability. The patched behavior rejects the unsupported operation with -EINVAL, preventing the warning path from being used as a denial-of-service primitive.

How to fix it

Upgrade to a Linux kernel or vendor-maintained kernel package that includes the upstream fix for the Ethos-U driver behavior, where NPU_OP_RESIZE requests are rejected with -EINVAL instead of reaching WARN_ON(1). Because no specific affected package list or fixed version was provided, use the fixed kernel version supplied by the relevant Linux distribution, device vendor, BSP provider, or embedded platform maintainer. As interim mitigation, restrict access to the Ethos-U DRM device node to only trusted users and services, remove unnecessary device passthrough into containers, and disable or unload the Ethos-U driver where the accelerator is not required. Review whether kernel.panic_on_warn is enabled; disabling it may reduce crash impact, but it should not be treated as a complete fix because log-spam denial of service may remain possible on vulnerable kernels.

How to confirm the fix worked

Confirm the running kernel includes the patch that replaces the unconditional WARN_ON(1) for NPU_OP_RESIZE in the accel/ethosu driver with an explicit -EINVAL return. Validate package status using the operating system or vendor advisory tooling, and confirm the host has rebooted into the remediated kernel rather than only installing the package. On source-based or embedded builds, inspect the Ethos-U driver code path for DRM_IOCTL_ETHOSU_GEM_CREATE and verify unsupported NPU_OP_RESIZE commands are rejected before hardware submission or WARN_ON execution. Check runtime exposure by identifying whether the Ethos-U driver is loaded and whether associated DRM device nodes are accessible to untrusted users or containers. A controlled negative test in a non-production environment should show that an NPU_OP_RESIZE request returns EINVAL and does not produce a kernel warning or panic.

Typical attack path

1. Gain local execution on a Linux system with the affected Arm Ethos-U accelerator DRM driver present.
2. Confirm the attacker-controlled user, process, or container can access the relevant DRM device node, commonly under /dev/dri/.
3. Open the Ethos-U DRM device and issue DRM_IOCTL_ETHOSU_GEM_CREATE with an NPU_OP_RESIZE command.
4. Trigger the vulnerable WARN_ON(1) path in the kernel driver.
5. If kernel.panic_on_warn is enabled, cause a kernel panic and system outage.
6. If kernel.panic_on_warn is disabled, repeat the request to generate excessive kernel warning logs and operational noise.

How to detect it

Look for signs of local triggering in kernel logs and system crash artifacts. Relevant sources include dmesg, journald kernel facility logs, /var/log/kern.log, /var/log/messages, crash dumps, kdump/vmcore records, and endpoint telemetry showing processes opening DRM device nodes. Search for repeated kernel warnings involving the Ethos-U accelerator driver, WARN_ON stack traces associated with GEM creation or resize operations, sudden bursts of kernel messages from the same host, and reboots or panics that correlate with access to /dev/dri devices. If auditd, eBPF telemetry, or EDR file/device access logging is enabled, review processes issuing ioctls to DRM devices shortly before warning storms or kernel panics. For containerized environments, check container runtime configuration and audit logs for direct passthrough of /dev/dri devices to untrusted workloads. There are no known public attacker-specific indicators, named threat actors, or ransomware campaigns associated with this vulnerability; detection should focus on behavioral evidence of repeated Ethos-U DRM ioctl abuse and kernel warning/panic artifacts.

• NPU_OP_RESIZE
• DRM_IOCTL_ETHOSU_GEM_CREATE
• ethosu
• accel/ethosu
• WARN_ON(1)
• kernel.panic_on_warn
• panic_on_warn
• /dev/dri/
• /var/log/kern.log
• /var/log/messages
• kernel panic
• Kernel panic - not syncing
• WARNING: CPU:
• Call Trace:

What your security team should do

• Prioritize patching systems that expose Arm Ethos-U accelerator DRM devices to untrusted users, multi-tenant workloads, containers, development shells, or edge applications.
• Apply the vendor-provided kernel update containing the Ethos-U NPU_OP_RESIZE rejection fix and reboot into the updated kernel.
• Inventory systems for loaded Ethos-U/ethosu kernel modules and accessible /dev/dri device nodes to determine real exposure.
• Restrict DRM device permissions and container device passthrough so only trusted services can access the accelerator.
• Review kernel.panic_on_warn settings on affected systems; where business risk permits, avoid enabling panic-on-warn on vulnerable hosts until patched.
• Monitor kernel logs for repeated Ethos-U driver warnings, WARN_ON traces, or unexpected kernel panics, especially from systems running untrusted local workloads.
• Treat repeated triggering as potential local abuse or post-compromise activity even though the vulnerability has low EPSS and is not currently in CISA KEV.