CVE-2026-68330 (GCVE-0-2026-68330)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-17 05:03
VLAI
Title
net: airoha: Fix DMA direction for NPU mailbox buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, but some callers expect the NPU to write response data back into the same buffer: - airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into the buffer, then the caller reads it via memcpy() - airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back npu_stats_addr field in the response On non-cache-coherent architectures like EN7581 (Cortex-A53 without hardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op — it does not invalidate the CPU cache. If the NPU-written cache line is still present in the CPU cache when the caller reads the buffer, the CPU observes stale data instead of the NPU response. This is a timing-sensitive bug: small mailbox buffers (~24 bytes) typically fit in a single cache line and may survive in the cache until the caller reads them, producing silent data corruption rather than a crash. The bug is more likely to trigger when the caller reads the response immediately after dma_unmap_single() without intervening cache-evicting operations. Fix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures dma_unmap_single() invalidates the CPU cache on non-coherent systems. The mailbox buffers are small so there is no performance concern.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c52918744ee1e49cea86622a2633b9782446428f , < 76fc5604308a109bf5838c2a0a0eb3ac6819f1ea (git)
Affected: c52918744ee1e49cea86622a2633b9782446428f , < 4c4d866a64f36718cbcdf20add372a599dd44311 (git)
Affected: c52918744ee1e49cea86622a2633b9782446428f , < 6f884eb87a79e0c482baef2ad96c96b81d024235 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/airoha/airoha_npu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "76fc5604308a109bf5838c2a0a0eb3ac6819f1ea",
              "status": "affected",
              "version": "c52918744ee1e49cea86622a2633b9782446428f",
              "versionType": "git"
            },
            {
              "lessThan": "4c4d866a64f36718cbcdf20add372a599dd44311",
              "status": "affected",
              "version": "c52918744ee1e49cea86622a2633b9782446428f",
              "versionType": "git"
            },
            {
              "lessThan": "6f884eb87a79e0c482baef2ad96c96b81d024235",
              "status": "affected",
              "version": "c52918744ee1e49cea86622a2633b9782446428f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/airoha/airoha_npu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix DMA direction for NPU mailbox buffer\n\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\n  the buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\n  npu_stats_addr field in the response\n\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n\u2014 it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\n\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\n\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is a host-side DMA-direction/cache-coherency error in the airoha NPU mailbox path; it is exercised through local driver probe, interface bring-up, and hardware flow-offload configuration, not by any remotely supplied packet data.\nAC:L - Each mailbox exchange on a non-coherent EN7581 SoC can return stale cache contents, and the affected setup paths can be re-entered repeatedly (offload teardown/re-setup, interface bring-up) while cache pressure is influenced by local activity, so the faulty read is reliably reproducible.\nPR:L - The vulnerable mailbox exchanges run during driver initialization and offload setup on these router SoCs; the lowest plausible trigger is an ordinary local user provoking interface/offload (re)initialization, and the probe-time instance requires no privileges at all.\nUI:N - No victim action is needed \u2014 the stale-response reads happen automatically during NPU/PPE/WLAN initialization and offload setup.\nS:U - The corrupted addresses and misdirected accesses stay within the kernel\u0027s own security authority on the affected SoC; no hypervisor or IOMMU security boundary is crossed by the defect itself.\nC:H - A stale npu_stats_addr causes devm_ioremap() of an unintended physical address whose contents are then read via memcpy_fromio() and exposed to userspace as flow-offload statistics, disclosing memory the driver was never meant to read.\nI:H - Stale responses are used as real addresses: memset_io() zeroes an unintended ioremapped region, and stale RXDESC_BASE values are written into WiFi ring descriptor base registers, causing device DMA writes into memory the driver does not own.\nA:H - Mapping and accessing a bogus physical address, and pointing hardware DMA rings at an invalid base, produce bus errors, descriptor-processing failures and memory corruption that lead to oops or system hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:03:28.769Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235"
        }
      ],
      "title": "net: airoha: Fix DMA direction for NPU mailbox buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68330",
    "datePublished": "2026-08-10T12:03:06.542Z",
    "dateReserved": "2026-07-30T09:28:09.383Z",
    "dateUpdated": "2026-08-17T05:03:28.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68330",
      "date": "2026-09-21",
      "epss": "0.00162",
      "percentile": "0.05782"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/airoha/airoha_npu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "76fc5604308a109bf5838c2a0a0eb3ac6819f1ea",
                    "status": "affected",
                    "version": "c52918744ee1e49cea86622a2633b9782446428f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c4d866a64f36718cbcdf20add372a599dd44311",
                    "status": "affected",
                    "version": "c52918744ee1e49cea86622a2633b9782446428f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6f884eb87a79e0c482baef2ad96c96b81d024235",
                    "status": "affected",
                    "version": "c52918744ee1e49cea86622a2633b9782446428f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/airoha/airoha_npu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix DMA direction for NPU mailbox buffer\n\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\n  the buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\n  npu_stats_addr field in the response\n\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n\u2014 it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\n\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\n\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern."
          }
        ],
        "id": "CVE-2026-68330",
        "lastModified": "2026-08-17T06:17:41.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:23.293",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:22:30+00:00",
      "cve": "CVE-2026-68330",
      "id": "CVE-2026-68330",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: airoha: Fix DMA direction for NPU mailbox buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68330.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:47:39Z",
      "cve": "CVE-2026-68330",
      "id": "CVE-2026-68330",
      "initial_release_date": "2026-08-11T23:47:39Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68330",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68330.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.