HIGH Introduced in 6.12
iommu CmdqvProbe UAF
CVE-2026-90427
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.
02KernelScan AI Analysis
Risk summary
A use-after-free in the NVIDIA Tegra241 CMDQV IOMMU driver's probe path can occur when a managed memory reallocation relocates and frees the original SMMU structure and a subsequent initialization step fails, causing the caller's fallback path to dereference the freed pointer. The bug is reachable only on systems with the specific Tegra241 (Grace) SoC hardware and the CMDQV driver enabled, during device probe at boot or when re-probed by a privileged actor. Impact ranges from kernel crash to potential memory corruption if the stale pointer is exploited.
Vulnerability analysis
During device probe, the Tegra241 CMDQV IOMMU driver grows the SMMU structure into a larger container using a managed reallocation that may relocate and free the original object. If a later initialization step fails, the inner helper signals failure without updating the caller's pointer, so the caller's fallback path dereferences the now-freed original structure — a use-after-free that can crash the kernel or corrupt memory. The fix changes the helper to return an error code and pass the SMMU pointer by reference, updating it to the reallocated address immediately after the reallocation succeeds, so both the success and fallback paths operate on the live object. The vulnerable surface is a hardware-specific IOMMU driver for the NVIDIA Tegra241 (Grace) SoC, reached via ACPI device discovery during boot; an unprivileged user cannot trigger the probe, and deliberate exploitation requires root or boot-level access to influence the probe sequence or ACPI configuration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.12 | 7.3-rc1 | d4d05f55e9da |
| 7.2 | 6.12 | 7.2.6 | 86197679b293 |