Cloudanix VulnDB

CVE-2026-90428

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver initialization ordering bug can cause certain Linux systems to crash when an error interrupt fires before internal structures are ready.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The error ISR is registered before the vintfs array and num_vintfs are allocated and zeroed; a latched interrupt from a prior kexec therefore dereferences an uninitialized array, causing invalid memory access inside tegra241_cmdqv_isr.

Why it matters to the business

Systems using the affected Tegra241 IOMMU driver may experience kernel panics or crashes on boot or after kexec when an error interrupt is pending, leading to unplanned downtime on impacted hardware.

How an attack unfolds

An attacker with the ability to trigger a kexec or reboot on a machine that has a latched CMDQV error can cause the kernel to request the error IRQ while the driver structures are still uninitialized, resulting in the ISR walking invalid memory and crashing the system.

How to fix it

Update the Linux kernel to a version containing the fix that moves IRQ request after vintfs allocation and zeroing; apply the patch that defers IRQ registration until after cmdqv->vintfs is valid.

How to confirm the fix worked

Confirm the driver source contains the corrected probe sequence that allocates and zeros vintfs before requesting the error IRQ; test kexec with a latched error on affected hardware to verify no crash occurs.

Typical attack path

  1. Obtain ability to perform kexec or reboot on target system
  2. Ensure a CMDQV error is latched before the reboot
  3. Trigger reboot or kexec so the driver requests the IRQ early
  4. ISR runs against the uninitialized vintfs array and panics the kernel

How to detect it

Search kernel logs and crash dumps for references to tegra241_cmdqv_isr or uninitialized vintfs access around boot or kexec events; look for panics occurring immediately after IRQ request in the probe path.

  • tegra241_cmdqv_isr
  • cmdqv->vintfs
  • num_vintfs
  • iommu/tegra241-cmdqv

What your security team should do

  • Prioritize kernel updates on all systems using the tegra241 CMDQV driver
  • Monitor for kernel oops or panic logs referencing tegra241_cmdqv_isr
  • Review boot and kexec procedures for environments with persistent IOMMU errors

The record

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips.

Affected packages

Ecosystem Package Introduced Fixed