Cloudanix VulnDB

CVE-2026-90425

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A kernel bug on certain hardware could let a compromised virtual machine bypass memory protections or crash the host system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The driver maps a guest vSID to only the first physical Stream ID from master->streams[0] and skips validation when num_streams is not exactly one, causing incomplete ATC/IOTLB invalidation for multi-stream devices and out-of-bounds reads against a ZERO_SIZE_PTR for devices with zero streams.

Why it matters to the business

Virtualized workloads on affected Tegra hardware risk IOMMU bypass, memory corruption, or crashes; delayed patching leaves systems exposed for 37 days with no known public exploits but potential for local privilege escalation.

How an attack unfolds

An attacker with local access provisions or attaches a device reporting multiple or zero streams, triggers vSID mapping, then issues invalidations that miss entries or trigger OOB reads, allowing DMA to unauthorized memory regions or kernel panic.

How to fix it

Upgrade to a Linux kernel containing the fix that rejects vSID mapping with -EOPNOTSUPP unless master->num_streams equals exactly one; rebuild and deploy the updated kernel image on all affected Tegra systems.

How to confirm the fix worked

Confirm the patched driver source contains the num_streams == 1 check returning -EOPNOTSUPP; test device attachment with both multi-stream and zero-stream configurations and verify rejection instead of partial mapping or OOB access.

Typical attack path

  1. Identify or configure a PCI/IO device exposing !=1 stream under the Tegra IOMMU
  2. Assign the device to a guest vSID via the vulnerable driver path
  3. Perform DMA operations followed by invalidation commands from the guest
  4. Observe missed cache entries enabling unauthorized memory access or kernel instability

How to detect it

Search kernel logs and dmesg for tegra241_vintf_init_vsid messages mentioning stream counts, warnings about non-single streams, or unexpected ZERO_SIZE_PTR accesses; correlate with guest DMA or invalidation activity.

  • tegra241_vintf_init_vsid
  • master->num_streams
  • ZERO_SIZE_PTR
  • -EOPNOTSUPP

What your security team should do

  • Prioritize kernel upgrade on all Tegra-based hosts within the next maintenance window
  • Audit IOMMU-enabled virtualization deployments for devices reporting multiple streams
  • Monitor kernel logs for tegra241_vintf_init_vsid warnings until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Reject the mapping with -EOPNOTSUPP if master->num_streams is not one.

Affected packages

Ecosystem Package Introduced Fixed