CVE-2026-98143

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

accel: ethosu: Don't read the U65 rounding mode as a storage mode

Bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage

mode on U85 only. On U65 the same field holds the rounding mode, and the

command stream parser has read it as a storage mode since the driver was

added.

That went unnoticed while unknown values fell through the switch, but

now that they are rejected, every U65 command stream that asks for

natural rounding (2) fails CMDSTREAM_BO_CREATE with -EINVAL. Mesa emits

it for average pooling, concatenation, split, unpack, strided slice, LUT

and argmax, which is 72 failures of the Teflon test suite on an i.MX93.

Truncating rounding (1) is misread as well: it picks the two-tile

address path and computes a bogus feature map size from tile bases the

command stream never set.

Read the field as a storage mode only on the hardware where it is one.

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References