CVE-2026-68316

CVE-2026-68316 is a command stream validation bypass in the Ethos-U neural processor driver. The flaw lives in the trust boundary itself—the code that's supposed to validate tensor commands before the accelerator executes them gets the math wrong, passing commands that should fail and setting up downstream buffer access violations. The vulnerability has two compounding errors. First, for NHWC format tensors, the driver completely omits element size from its buffer size calculation—a classic template drift failure where someone copied the NCHW validation path, changed the format constant, and left the arithmetic intact. Second, even for other tensor formats, the driver applies the wrong bitfield interpretation: it reads element size encoding from bits 1:2 for OFM (output feature maps) but bits 2:3 for IFM and IFM2 (input feature maps). The hardware specification uses different encoding schemes for what is semantically identical information, and the driver only got one path right. The CVSS of 7.8 reflects kernel context and exploitability, but the real blast radius question hinges on Ethos-U's DMA capability. When validation undercounts buffer size, malformed commands can cause the accelerator to write tensor outputs to miscalculated physical addresses via DMA. This isn't a bounded kernel heap overflow—it potentially bypasses isolation boundaries between the accelerator and system memory. In systems where Ethos-U shares memory with a Trusted Execution Environment or secure world, this size miscalculation could create a cross-domain leakage path that EPSS doesn't measure. For defenders: determine whether your Ethos-U deployment runs in multi-user contexts where userspace can influence command stream contents, or in isolated embedded contexts. Review driver versions against the patch for both the NHWC multiplication fix and the OFM bitfield realignment. Watch for memory errors logged as DMA timeouts or hardware faults—the corruption this creates may appear as a hardware fault rather than a software exploit, creating attribution blur that evades detection. The detection gap may mean exploitation probability exceeds what EPSS suggests, particularly in instrumented deployments where this class of bug gets logged as a hardware anomaly rather than a security event.

Reviewed through automated stages and approved by a human before publication.