CVE-2026-90424

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path

tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits

it, and preallocates its logical VCMDQs. Two of its error paths leak.

When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the

cmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach

it; free it directly there.

A later VCMDQ preallocation failure instead leaves VINTF0 published, and so

this time the unwind does reach tegra241_cmdqv_remove_vintf(), which then

frees it from vintf->hyp_own. But tegra241_vintf_hw_init() sets that flag

only afterward, from a HW read-back, so the still-uninited VINTF0 reads as

guest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields

it never set up.

Decide ownership from vintf->idx instead, the index assigned when its id is

allocated: idx 0 is the kernel-owned VINTF0, while idx >= 1 marks a gues

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References