Cloudanix VulnDB

CVE-2026-80818

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel code for certain NVIDIA Tegra hardware can cause the system to crash when a device driver is loaded or removed under error conditions.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the command queue handling path where arm_smmu_impl_remove triggers tegra241_cmdqv_remove_vintf which issues CMD_SYNC against memory already released by arm_smmu_init_queues during devres unwind on probe failure or unbind.

Why it matters to the business

Kernel oops and potential system instability or crash on affected Tegra-based IOMMU devices during driver load, unload, or error paths, increasing downtime risk for systems relying on this hardware.

How an attack unfolds

An attacker with local access or the ability to induce device probe failure (such as VCMDQ enable errors) triggers the devres unwind sequence, causing the IOMMU removal path to reference the already-freed command queue and produce a paging fault.

How to fix it

Apply the upstream fix that removes VINTF deinit from tegra241_cmdqv_remove_vintf, adds a device_disable implementation, and quiesces VINTFs from arm_smmu_disable_action while the CMDQ remains valid; rebuild and deploy the updated kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting the tegra241_cmdqv and arm_smmu code paths for the new device_disable op and removal of the problematic deinit call; reproduce the QEMU-induced probe failure scenario and verify no paging request occurs on the queue address.

Typical attack path

  1. Trigger conditions that cause arm_smmu_impl_probe to fail or initiate device unbind
  2. Allow devres unwind to free smmu->cmdq.q.base before arm_smmu_impl_remove executes
  3. tegra241_cmdqv_remove_vintf issues CMD_SYNC on the freed queue memory
  4. Kernel page fault handler logs the oops and terminates the affected process or panics

How to detect it

Search kernel logs and dmesg for the strings 'failed to enable', 'GERRORN=0x0', 'uncleared error detected', 'failed to reset impl', and the call trace containing arm_smmu_cmdq_issue_cmdlist followed by tegra241_vcmdq_hw_deinit.

  • arm_smmu_cmdq_issue_cmdlist+0x320/0x6fc
  • tegra241_vcmdq_hw_deinit+0x98/0x168
  • VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000
  • Unable to handle kernel paging request at virtual address ffff8000

What your security team should do

  • Prioritize kernel update for any systems exposing the arm-smmu-v3 driver on Tegra241 hardware
  • Monitor kernel logs for the specific GERROR and VCMDQ enable failure messages during boot or driver reload
  • Test device unbind and error injection paths in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown arm_smmu_impl_remove() is registered as a devres action in arm_smmu_impl_probe(), before arm_smmu_init_queues() allocates smmu->cmdq.q.base. On a devres unwind, whether a failed probe or an unbind, the queue is freed first and arm_smmu_impl_remove() then runs tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC on the freed memory. Observed during testing with a QEMU hack that makes the VCMDQ fail to enable, so the impl reset fails and probe aborts into the devres unwind: platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: uncleared error detected, resetting arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110 Unable to handle kernel paging request at virtual address ffff8000891e0098 ... Internal error: Oops: 0000000096000047 [#1] SMP ... Call trace: arm_smmu_cmdq_issue_cmdlist+0x320/0x6fc (P) tegra241_vcmdq_hw_deinit+0x98/0x168 tegra241_vintf_hw_deinit+0x5c/0x1b0 tegra241_cmdqv_remove_vintf+0x34/0xec tegra241_cmdqv_remove+0x40/0x9c arm_smmu_impl_remove+0x20/0x30 devm_action_release+0x14/0x20 devres_release_all+0xa8/0x110 device_unbind_cleanup+0x18/0x84 really_probe+0x1f0/0x29c Drop the VINTF deinit from tegra241_cmdqv_remove_vintf() so the unwind no longer touches the freed queue. Quiesce the VINTFs earlier instead. Add a device_disable() impl op and run it from arm_smmu_disable_action() while the CMDQ is still up. That handles a live unbind. A failed reset is already handled because tegra241_vintf_hw_init() deinits the VINTF on its own error path. tegra241_cmdqv_remove_vintf() is also used by the iommufd viommu destroy path, so quiesce there too.

Affected packages

Ecosystem Package Introduced Fixed