Type conversion in Linux kernel - CVE-2026-98143
Published: September 28, 2026
Vulnerability identifier: #VU152308
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98143
CWE-ID: CWE-704
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause command stream processing failures or incorrect feature map size calculations.
The vulnerability exists due to incorrect interpretation of a hardware-specific precision field in the Ethos-U command stream parser when processing U65 command streams with rounding modes. A local user can submit a U65 command stream using natural or truncating rounding to cause command stream processing failures or incorrect feature map size calculations.
Natural rounding is emitted for operations including average pooling, concatenation, split, unpack, strided slice, LUT, and argmax.
Affected software
Linux kernel
How to mitigate CVE-2026-98143
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3