CVE-2026-68330

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68330", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.383Z", "datePublished": "2026-08-10T12:03:06.542Z", "dateUpdated": "2026-08-17T05:03:28.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:03:28.769Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix DMA direction for NPU mailbox buffer\n\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\n the buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\n npu_stats_addr field in the response\n\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n\u2014 it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\n\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\n\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The defect is a host-side DMA-direction/cache-coherency error in the airoha NPU mailbox path; it is exercised through local driver probe, interface bring-up, and hardware flow-offload configuration, not by any remotely supplied packet data.\nAC:L - Each mailbox exchange on a non-coherent EN7581 SoC can return stale cache contents, and the affected setup paths can be re-entered repeatedly (offload teardown/re-setup, interface bring-up) while cache pressure is influenced by local activity, so the faulty read is reliably reproducible.\nPR:L - The vulnerable mailbox exchanges run during driver initialization and offload setup on these router SoCs; the lowest plausible trigger is an ordinary local user provoking interface/offload (re)initialization, and the probe-time instance requires no privileges at all.\nUI:N - No victim action is needed \u2014 the stale-response reads happen automatically during NPU/PPE/WLAN initialization and offload setup.\nS:U - The corrupted addresses and misdirected accesses stay within the kernel's own security authority on the affected SoC; no hypervisor or IOMMU security boundary is crossed by the defect itself.\nC:H - A stale npu_stats_addr causes devm_ioremap() of an unintended physical address whose contents are then read via memcpy_fromio() and exposed to userspace as flow-offload statistics, disclosing memory the driver was never meant to read.\nI:H - Stale responses are used as real addresses: memset_io() zeroes an unintended ioremapped region, and stale RXDESC_BASE values are written into WiFi ring descriptor base registers, causing device DMA writes into memory the driver does not own.\nA:H - Mapping and accessing a bogus physical address, and pointing hardware DMA rings at an invalid base, produce bus errors, descriptor-processing failures and memory corruption that lead to oops or system hang."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "versions": [{"version": "c52918744ee1e49cea86622a2633b9782446428f", "lessThan": "76fc5604308a109bf5838c2a0a0eb3ac6819f1ea", "status": "affected", "versionType": "git"}, {"version": "c52918744ee1e49cea86622a2633b9782446428f", "lessThan": "4c4d866a64f36718cbcdf20add372a599dd44311", "status": "affected", "versionType": "git"}, {"version": "c52918744ee1e49cea86622a2633b9782446428f", "lessThan": "6f884eb87a79e0c482baef2ad96c96b81d024235", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"}, {"url": "https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311"}, {"url": "https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235"}], "title": "net: airoha: Fix DMA direction for NPU mailbox buffer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "76fc5604308a109bf5838c2a0a0eb3ac6819f1ea", "status": "affected", "version": "c52918744ee1e49cea86622a2633b9782446428f", "versionType": "git"}, {"lessThan": "4c4d866a64f36718cbcdf20add372a599dd44311", "status": "affected", "version": "c52918744ee1e49cea86622a2633b9782446428f", "versionType": "git"}, {"lessThan": "6f884eb87a79e0c482baef2ad96c96b81d024235", "status": "affected", "version": "c52918744ee1e49cea86622a2633b9782446428f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/airoha/airoha_npu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix DMA direction for NPU mailbox buffer\n\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\n the buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\n npu_stats_addr field in the response\n\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n\u2014 it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\n\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\n\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern."}], "id": "CVE-2026-68330", "lastModified": "2026-08-17T06:17:41.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:23.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Silent data corruption in airoha driver due to incorrect DMA mapping", "id": "2513288", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513288"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: airoha: Fix DMA direction for NPU mailbox buffer\nairoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE,\nbut some callers expect the NPU to write response data back into the\nsame buffer:\n- airoha_npu_wlan_msg_get() (NPU_OP_GET): NPU writes response into\nthe buffer, then the caller reads it via memcpy()\n- airoha_npu_ppe_stats_setup() (NPU_OP_SET): NPU writes back\nnpu_stats_addr field in the response\nOn non-cache-coherent architectures like EN7581 (Cortex-A53 without\nhardware cache coherency for NPU DMA), DMA_TO_DEVICE unmap is a no-op\n\u2014 it does not invalidate the CPU cache. If the NPU-written cache line\nis still present in the CPU cache when the caller reads the buffer,\nthe CPU observes stale data instead of the NPU response.\nThis is a timing-sensitive bug: small mailbox buffers (~24 bytes)\ntypically fit in a single cache line and may survive in the cache\nuntil the caller reads them, producing silent data corruption rather\nthan a crash. The bug is more likely to trigger when the caller reads\nthe response immediately after dma_unmap_single() without intervening\ncache-evicting operations.\nFix by using DMA_BIDIRECTIONAL for both map and unmap, which ensures\ndma_unmap_single() invalidates the CPU cache on non-coherent systems.\nThe mailbox buffers are small so there is no performance concern.", "A flaw was found in the Linux kernel's airoha network driver. This vulnerability arises from an incorrect configuration of Direct Memory Access (DMA) for the Network Processing Unit (NPU) mailbox buffer. Specifically, the system incorrectly maps the buffer for data transfer only to the device, even when the NPU is expected to write response data back into the same buffer. On systems without hardware cache coherency, this can lead to the Central Processing Unit (CPU) reading outdated information from its cache instead of the NPU's response, resulting in silent data corruption. This issue can cause critical system data to be silently corrupted, potentially impacting system stability and integrity."], "name": "CVE-2026-68330", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:03:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68330\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68330\nhttps://git.kernel.org/stable/c/4c4d866a64f36718cbcdf20add372a599dd44311\nhttps://git.kernel.org/stable/c/6f884eb87a79e0c482baef2ad96c96b81d024235\nhttps://git.kernel.org/stable/c/76fc5604308a109bf5838c2a0a0eb3ac6819f1ea"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52918744ee1e49cea86622a2633b9782446428f,76fc5604308a109bf5838c2a0a0eb3ac6819f1ea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52918744ee1e49cea86622a2633b9782446428f,4c4d866a64f36718cbcdf20add372a599dd44311)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52918744ee1e49cea86622a2633b9782446428f,6f884eb87a79e0c482baef2ad96c96b81d024235)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T16:00:04.017458+00:00", "updated": "2026-08-14T03:15:12.992259+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}