Attributed metadata history
Up to 100 retained publisher events per page for f1b58e197bfe9f3c08d91e8ca4b9c9e5fd0548cfc797ce604515fe07d4500a7f. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_350d40f2cc69277bca
observed · 2026-10-12 08:34:02 UTC
Summary In a previous advisory we disclosed multiple vulnerabilities within the NPU device’s mmap handler and discussed how it exposes sensitive kernel data. This advisory focuses on the implementation errors in the same handler. The mapping function ignores the requested size parameter and fails to back regions of the mapped virtual memory with an actual mapping. Trying to access these holes or requesting an mmap that is smaller than the memory mapped by the kernel driver results in a kernel crash, most likely caused by invalid page accesses. The mmap handler is exposed through the /dev/davinci0 character device. Due to the applied selinux policy, access to this device is restricted to the hiaiserver system process.
Fingerprint: 5e9f435158ca1137c6376b6e1bf2934e1ed9a526d794a2e27ac5859a6e90060c
intelligence_src_350d40f2cc69277bca
observed · 2026-10-12 08:34:02 UTC
available
Fingerprint: fe0fdc07a129ff203534388ab215df24d870069207d85287923a2a35a12b5578