CVE-2026-90430

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized

tegra241_vintf_init_lvcmdq() stores the freshly allocated vcmdq pointer to

the vintf->lvcmdqs[] array, before tegra241_vcmdq_alloc_smmu_cmdq() builds

the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ

error (e.g. one inherited across a kexec) firing in this window would make

tegra241_vintf0_handle_error() pass the still-zeroed arm_smmu_cmdq down to

__arm_smmu_cmdq_skip_err(), dereferencing NULL queue register pointers.

Drop the store from tegra241_vintf_init_lvcmdq() and publish the vcmdq at

the end of the allocation instead, with an smp_store_release() that pairs

with an smp_load_acquire() in the ISR, which can see a fully built LVCMDQ

or NULL.

The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq

once tegra241_vcmdq_hw_init_user() succeeds, using a plain store since a

user VINTF's lvcmdqs[] has no

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References