CVE-2026-68330

A flaw was found in the Linux kernel's airoha network driver. This vulnerability arises from an incorrect configuration of Direct Memory Access (DMA) for the Network Processing Unit (NPU) mailbox buffer. Specifically, the system incorrectly maps the buffer for data transfer only to the device, even when the NPU is expected to write response data back into the same buffer. On systems without hardware cache coherency, this can lead to the Central Processing Unit (CPU) reading outdated information from its cache instead of the NPU's response, resulting in silent data corruption. This issue can cause critical system data to be silently corrupted, potentially impacting system stability and integrity.

This issue affects Airoha network SoCs. NPU mailbox DMA mapped TO_DEVICE but NPU writes response back. Systems without airoha hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.