CVE-2026-90426

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs

tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq().

Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in

that window makes tegra241_cmdqv_isr() read the stale slot and hand it to

tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer.

Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight

handlers to finish and blocks new ones, so no ISR can observe a VINTF as it

is torn down.

Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps

cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches

freed memory. This is neither introduced nor fixed here: a physical IOMMU

is not a pluggable device, so iommufd by design holds no reference on the

one behind a viommu, and this teardown is not expected while that viommu is

still alive.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References