CVE-2026-90430

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq stores the freshly allocated vcmdq pointer to the vintf-lvcmdqs array, before tegra241vcmdqallocsmmucmdq builds the vcmdq-cmdq. Th...

CVE-2026-90429 iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

CVE-2026-90429

CVE-2026-90429 is a race condition in the Linux kernel's iommu/tegra241-cmdqv driver (NVIDIA Tegra 241 IOMMU). The error interrupt service routine (ISR) can read a cmdqv->vintfs[] slot concurrently with VINTF teardown or initialization, leading to a NULL dereference , a use-after-free , or a s...

CVE-2026-90428 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-90428

CVE-2026-90428 affects the Linux kernel driver iommu/tegra241-cmdqv (NVIDIA Tegra 241 CMDQV IOMMU). The root cause is that __tegra241_cmdqv_probe() requests the error IRQ before allocating the cmdqv->vintfs array and setting cmdqv->num_vintfs. If a CMDQV is left enabled with a latched error...