CVE-2026-90427

What it actually does

Use-after-free in the IOMMU Tegra driver where devm_krealloc frees the original smmu pointer on success, but a later failure causes the caller fallback path to dereference the now-freed pointer.

Why it matters to the business

On affected embedded or server systems using the Tegra IOMMU driver, a local attacker could trigger a kernel crash or attempt to execute arbitrary code with kernel privileges; impact is limited by the need for precise timing during device probe and low observed exploitation rates.

How an attack unfolds

An attacker with local access triggers __tegra241_cmdqv_probe(), causes devm_krealloc to relocate and free the original smmu, then forces a subsequent failure so the fallback path dereferences the dangling pointer, potentially leading to memory corruption.

How to fix it

Apply the upstream kernel commit that changes __tegra241_cmdqv_probe to return an int, accept smmu by reference, and update the pointer only after successful reallocation so both success and fallback paths use a live pointer.

How to confirm the fix worked

Inspect the probe function in the iommu/tegra241-cmdqv.c source to confirm it returns int, takes smmu by reference, and updates *smmu after devm_krealloc succeeds before any fallback usage.

Typical attack path

1. Obtain local access to a system using the affected Tegra IOMMU driver
2. Trigger or wait for device probe that calls __tegra241_cmdqv_probe
3. Arrange for devm_krealloc to succeed followed by a later failure condition
4. Cause the fallback path to dereference the freed smmu pointer
5. Leverage resulting memory corruption for crash or code execution

How to detect it

Search kernel logs and dmesg for IOMMU probe failures or use-after-free warnings involving tegra241_cmdqv on Tegra hardware; examine crash dumps for dereference of freed smmu pointers during device initialization.

What your security team should do

• Prioritize kernel updates containing the fix on any Tegra-based systems
• Review device probe logs for IOMMU initialization failures on affected hardware
• Limit local unprivileged access on systems where the driver is active until patched