CVE-2026-89450: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field
tegra241vintfinitvsid() programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID.
The bound check rejects only virtsid > UINTMAX, which admits a value far wider than the field. The write "virtsid << 1 | 0x1" then drops every bit above 20: a virtsid of 0x80000000 lands as SIDMATCH = 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virtid is guest-controlled, a VMM can trigger it.
Validate virtsid against the field width with FIELDMAX(), and program the register with FIELDPREP() so the value and the field stay consistent.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the incorrect Stream ID match?
A VMM can trigger it because the virtual device ID used as the vSID is guest-controlled. The issue arises when that value is wider than the 20-bit VIRT_SID portion of the SID_MATCH register field.
What happens when an oversized vSID is accepted?
Bits above the 20-bit hardware field are dropped when the value is written to SID_MATCH, potentially causing the entry to match a different Stream ID. For example, a vSID of 0x80000000 becomes SID_MATCH value 0x1, which enables a match for vSID 0.
What can be done before applying the resolved kernel change?
Ensure VMM-provided virtual Stream IDs fit within the 20-bit SID_MATCH VIRT_SID field, meaning values no greater than 0xFFFFF. The resolved change validates the value against the field maximum and uses field-aware register programming.