Skip to content
Heist/ feed
Back to feed
HighFix available

accel: ethosu: Ensure SRAM region size matches job

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped and a stale base address from a prior job is used. Check the region size against the job's SRAM size instead of just the size of the SRAM. The job's SRAM size was already checked against the total SRAM size.

Products
Kernel
Affected versions
Not specified
Fixed versions
7.2.7
CVEs
CVE-2026-97911
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 01:57 UTC · Revision 1

Source evidence

accel: ethosu: Ensure SRAM region size matches job

core-osv · Original source

Published 25 Sept 2026, 10:22 UTC

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped and a stale base address from a prior job is used. Check the region size against the job's SRAM size instead of just the size of the SRAM. The job's SRAM size was already checked against the total SRAM size.

osv:CVE-2026-97911

Kernel

Fixed versions: 7.2.7

Complete source record
{
  "id": "ed71489a664abb00421bf4ffc64939badf3ef1904557cb37fd65486c8774a395",
  "url": "https://osv.dev/vulnerability/CVE-2026-97911",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "accel: ethosu: Ensure SRAM region size matches job",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped and a stale base address from a prior job is used. Check the region size against the job's SRAM size instead of just the size of the SRAM. The job's SRAM size was already checked against the total SRAM size.",
    "evidence": "osv:CVE-2026-97911",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.2.7",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-97911",
      "aliases": [
        "CVE-2026-97911"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "9cff90774872ed6613b7571ce018b5b455d86890"
                },
                {
                  "fixed": "50c27d412fedc95b8d54d477af47451a382e8cdd"
                },
                {
                  "fixed": "2b39d680c9e0fb4d625f2916980977622e84248c"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97911.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "7.2.0"
                },
                {
                  "fixed": "7.2.7"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97911.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.814555704Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2b39d680c9e0fb4d625f2916980977622e84248c",
        "https://git.kernel.org/stable/c/50c27d412fedc95b8d54d477af47451a382e8cdd",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97911.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-97911",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97911.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-97911",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517164,
  "published_at": "2026-09-25T10:22:34.639+00:00"
}