Riskcovery

CVE-2026-90428

iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

__tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array.

Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before b1605a56745f22670205f6561df5771bbbb62a99Affected
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before 2f627118b668659c6b195ac48beedb1bf8f53368Affected
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before a168254ff8db08f2292be3d8fcbd37d2bb8c3d2dAffected
  • 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to before 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbdAffected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.