Riskcovery

CVE-2026-90427

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

State
Published
Severity
7.4 High
Published
Sep 17, 2026
Updated
Oct 21, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path.

Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before ea2edb27ef2648d8687cd0fc3ec3ba1793436e7eAffected
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before 268cbe3a36ae57a2ec09601f343b92f6f092d505Affected
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before 86197679b293f0601c3331d545f99a70a7780aa9Affected
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before d4d05f55e9da646ec03adfa77260eb46f4163749Affected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.