159 lines
9.6 KiB
JSON
159 lines
9.6 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-68330",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-30T09:28:09.383Z",
|
|
"datePublished": "2026-08-10T12:03:06.542Z",
|
|
"dateUpdated": "2026-08-17T05:03:28.769Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T05:03:28.769Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix DMA direction for NPU mailbox buffer\n\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\n the buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\n npu_stats_addr field in the response\n\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n— it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\n\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\n\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The defect is a host-side DMA-direction/cache-coherency error in the airoha NPU mailbox path; it is exercised through local driver probe, interface bring-up, and hardware flow-offload configuration, not by any remotely supplied packet data.\nAC:L - Each mailbox exchange on a non-coherent EN7581 SoC can return stale cache contents, and the affected setup paths can be re-entered repeatedly (offload teardown/re-setup, interface bring-up) while cache pressure is influenced by local activity, so the faulty read is reliably reproducible.\nPR:L - The vulnerable mailbox exchanges run during driver initialization and offload setup on these router SoCs; the lowest plausible trigger is an ordinary local user provoking interface/offload (re)initialization, and the probe-time instance requires no privileges at all.\nUI:N - No victim action is needed — the stale-response reads happen automatically during NPU/PPE/WLAN initialization and offload setup.\nS:U - The corrupted addresses and misdirected accesses stay within the kernel's own security authority on the affected SoC; no hypervisor or IOMMU security boundary is crossed by the defect itself.\nC:H - A stale npu_stats_addr causes devm_ioremap() of an unintended physical address whose contents are then read via memcpy_fromio() and exposed to userspace as flow-offload statistics, disclosing memory the driver was never meant to read.\nI:H - Stale responses are used as real addresses: memset_io() zeroes an unintended ioremapped region, and stale RXDESC_BASE values are written into WiFi ring descriptor base registers, causing device DMA writes into memory the driver does not own.\nA:H - Mapping and accessing a bogus physical address, and pointing hardware DMA rings at an invalid base, produce bus errors, descriptor-processing failures and memory corruption that lead to oops or system hang."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/airoha/airoha_npu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "c52918744ee1e49cea86622a2633b9782446428f",
|
|
"lessThan": "76fc5604308a109bf5838c2a0a0eb3ac6819f1ea",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c52918744ee1e49cea86622a2633b9782446428f",
|
|
"lessThan": "4c4d866a64f36718cbcdf20add372a599dd44311",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c52918744ee1e49cea86622a2633b9782446428f",
|
|
"lessThan": "6f884eb87a79e0c482baef2ad96c96b81d024235",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/airoha/airoha_npu.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.16",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.16",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.42",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.6",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.16",
|
|
"versionEndExcluding": "6.18.42"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.16",
|
|
"versionEndExcluding": "7.1.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.16",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235"
|
|
}
|
|
],
|
|
"title": "net: airoha: Fix DMA direction for NPU mailbox buffer",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |