CVE-2026-90429

CVE-2026-90429 is a race condition in the Linux kernel's iommu/tegra241-cmdqv driver (NVIDIA Tegra241 IOMMU). The error interrupt handler (tegra241_cmdqv_isr) dereferences VINTF slots concurrently with VINTF initialization or teardown, with no synchronization between them. On weakly-ordered CPUs ...

CVE-2026-90428

CVE-2026-90428 affects the Linux kernel driver iommu/tegra241-cmdqv (NVIDIA Tegra 241 CMDQV IOMMU). The root cause is that __tegra241_cmdqv_probe() requests the error IRQ before allocating the cmdqv->vintfs array and setting cmdqv->num_vintfs. If a CMDQV is left enabled with a latched error...