CVE-2026-97914

Description

A flaw was found in the Linux kernel's Arm Ethos-U accelerator driver. When scheduler initialization fails during a job open operation, the driver returns an incorrect positive status code instead of a standard negative error number. A local user can trigger this issue by opening an accelerator job file descriptor, which may cause user-space applications to improperly handle initialization failures and lead to unexpected behavior.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.5N/AN/A
Attack VectorLocalN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredLowN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityNoneN/AN/A
Integrity ImpactNoneN/AN/A
Availability ImpactHighN/AN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Understanding the Weakness (CWE)

CWE-393

Integrity,Other

Technical Impact: Unexpected State; Alter Execution Logic

This weakness can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the product to assume that an action is safe or correct, even when it is not. This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.