CVE-2026-68330: In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buff
Summary
A bug in the Linux kernel's airoha network driver causes data corruption on systems without hardware cache coherency (like EN7581 processors). The driver maps a mailbox buffer (a shared memory area for communication between the CPU and NPU, which is a network processing unit) with DMA_TO_DEVICE (a setting that only allows CPU-to-device data transfer), but the NPU needs to write response data back into the same buffer. When the NPU writes data, the CPU cache isn't properly refreshed, so the calling code reads stale cached data instead of the NPU's response.
Solution / Mitigation
Fix by using DMA_BIDIRECTIONAL for both map and unmap operations, which ensures dma_unmap_single() (the function that releases DMA access to memory) invalidates the CPU cache on non-coherent systems.
Vulnerability Details
EPSS: 0.0%
August 10, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-68330
First tracked: August 10, 2026 at 02:08 PM
Classified by LLM (prompt v3) · confidence: 95%