Cloudanix VulnDB

CVE-2026-90426

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing mistake when shutting down certain hardware drivers in the Linux kernel can let the system try to use memory that has already been freed, risking crashes or security problems.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Other
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free in tegra241_cmdqv_remove() where VINTF teardown precedes free_irq(), allowing the ISR to observe a stale or freed vintf slot and dereference a NULL or invalid pointer; a secondary path allows a user-owned VINTF to outlive cmdqv teardown and access unmapped/freed memory.

Why it matters to the business

Kernel instability or crashes on systems using the affected Tegra IOMMU driver during device removal or viommu operations, with potential for local privilege escalation if the freed memory is attacker-controlled.

How an attack unfolds

An attacker with local access triggers concurrent VINTF teardown and error IRQ handling, or closes a viommu after the physical IOMMU teardown has unmapped memory, causing the handler to dereference freed structures.

How to fix it

Update to a Linux kernel containing the fix that moves free_irq() before VINTF teardown; apply the corrected ordering in tegra241_cmdqv_remove() and ensure iommufd holds proper references for any viommu-backed IOMMU.

How to confirm the fix worked

Confirm the source contains the corrected free_irq() call before the VINTF loop in tegra241_cmdqv_remove(); test module unload under concurrent error injection and viommu close workloads for absence of use-after-free reports.

Typical attack path

  1. Obtain local access on a system exposing the tegra241-cmdqv IOMMU driver
  2. Trigger device removal or module unload while an error IRQ is pending or a viommu handle remains open
  3. Race the ISR against vintf teardown to read the stale slot
  4. Cause tegra241_vintf0_handle_error to dereference the freed or NULL pointer

How to detect it

Search kernel logs for tegra241_cmdqv_remove, tegra241_cmdqv_isr, and tegra241_vintf0_handle_error call sequences around module unload or device hot-remove events; look for NULL pointer dereference or slab-use-after-free reports referencing cmdqv or vintf structures.

What your security team should do

  • Prioritize kernel updates on any Tegra-based systems using this IOMMU driver
  • Monitor for device removal events in logs on affected hardware
  • Restrict unprivileged access to IOMMU and viommu interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq(). Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in that window makes tegra241_cmdqv_isr() read the stale slot and hand it to tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer. Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight handlers to finish and blocks new ones, so no ISR can observe a VINTF as it is torn down. Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches freed memory. This is neither introduced nor fixed here: a physical IOMMU is not a pluggable device, so iommufd by design holds no reference on the one behind a viommu, and this teardown is not expected while that viommu is still alive.

Affected packages

Ecosystem Package Introduced Fixed