{"api_version":"1","generated_at":"2026-09-25T12:40:35+00:00","cve":"CVE-2026-98143","urls":{"html":"https://cve.report/CVE-2026-98143","api":"https://cve.report/api/cve/CVE-2026-98143.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98143","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98143"},"summary":{"title":"accel: ethosu: Don't read the U65 rounding mode as a storage mode","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Don't read the U65 rounding mode as a storage mode\n\nBits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage\nmode on U85 only. On U65 the same field holds the rounding mode, and the\ncommand stream parser has read it as a storage mode since the driver was\nadded.\n\nThat went unnoticed while unknown values fell through the switch, but\nnow that they are rejected, every U65 command stream that asks for\nnatural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits\nit for average pooling, concatenation, split, unpack, strided slice, LUT\nand argmax, which is 72 failures of the Teflon test suite on an i.MX93.\nTruncating rounding (1) is misread as well: it picks the two-tile\naddress path and computes a bogus feature map size from tile bases the\ncommand stream never set.\n\nRead the field as a storage mode only on the hardware where it is one.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:45","updated_at":"2026-09-25 11:17:45"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/6b08adbda8ea797849e3654ce12cb3856ce6051a","name":"https://git.kernel.org/stable/c/6b08adbda8ea797849e3654ce12cb3856ce6051a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/db9deec5a345abc538d081fb221dc0b00a9695bd","name":"https://git.kernel.org/stable/c/db9deec5a345abc538d081fb221dc0b00a9695bd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98143","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98143","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b 6b08adbda8ea797849e3654ce12cb3856ce6051a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b db9deec5a345abc538d081fb221dc0b00a9695bd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/accel/ethosu/ethosu_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6b08adbda8ea797849e3654ce12cb3856ce6051a","status":"affected","version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","versionType":"git"},{"lessThan":"db9deec5a345abc538d081fb221dc0b00a9695bd","status":"affected","version":"5a5e9c0228e613f0ef2a58b9782d7c0ea8f1e58b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/accel/ethosu/ethosu_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Don't read the U65 rounding mode as a storage mode\n\nBits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage\nmode on U85 only. On U65 the same field holds the rounding mode, and the\ncommand stream parser has read it as a storage mode since the driver was\nadded.\n\nThat went unnoticed while unknown values fell through the switch, but\nnow that they are rejected, every U65 command stream that asks for\nnatural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits\nit for average pooling, concatenation, split, unpack, strided slice, LUT\nand argmax, which is 72 failures of the Teflon test suite on an i.MX93.\nTruncating rounding (1) is misread as well: it picks the two-tile\naddress path and computes a bogus feature map size from tile bases the\ncommand stream never set.\n\nRead the field as a storage mode only on the hardware where it is one."}],"providerMetadata":{"dateUpdated":"2026-09-25T10:36:18.470Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/6b08adbda8ea797849e3654ce12cb3856ce6051a"},{"url":"https://git.kernel.org/stable/c/db9deec5a345abc538d081fb221dc0b00a9695bd"}],"title":"accel: ethosu: Don't read the U65 rounding mode as a storage mode","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98143","datePublished":"2026-09-25T10:36:18.470Z","dateReserved":"2026-09-25T10:25:14.319Z","dateUpdated":"2026-09-25T10:36:18.470Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:45","lastModifiedDate":"2026-09-25 11:17:45","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98143","Ordinal":"1","Title":"accel: ethosu: Don't read the U65 rounding mode as a storage mod","CVE":"CVE-2026-98143","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98143","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel: ethosu: Don't read the U65 rounding mode as a storage mode\n\nBits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage\nmode on U85 only. On U65 the same field holds the rounding mode, and the\ncommand stream parser has read it as a storage mode since the driver was\nadded.\n\nThat went unnoticed while unknown values fell through the switch, but\nnow that they are rejected, every U65 command stream that asks for\nnatural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits\nit for average pooling, concatenation, split, unpack, strided slice, LUT\nand argmax, which is 72 failures of the Teflon test suite on an i.MX93.\nTruncating rounding (1) is misread as well: it picks the two-tile\naddress path and computes a bogus feature map size from tile bases the\ncommand stream never set.\n\nRead the field as a storage mode only on the hardware where it is one.","Type":"Description","Title":"accel: ethosu: Don't read the U65 rounding mode as a storage mod"}]}}}