EUVD-2026-82090

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

CVE-2026-90426

CVE-2026-90426 affects the Linux kernel 's tegra241-cmdqv IOMMU driver. In tegra241_cmdqv_remove(), VINTFs are torn down before the error IRQ is freed, creating a window where the ISR can read a stale cmdqv->vintfs[0] slot and pass a NULL or freed pointer to tegra241_vintf0_handle_error(), cau...

EUVD-2026-82087

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

CVE-2026-90426 iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...