CVE-2026-90427: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devmkrealloc()
tegra241cmdqvprobe() uses devmkrealloc() to grow @smmu into the larger tegra241cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path.
Return an int and take @smmu by reference instead, then update smmu to the reallocated pointer after devmkrealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.
Affected Software
Event History
Frequently Asked Questions
Under what condition can the faulty fallback path be reached?
It is reached when __tegra241_cmdqv_probe() grows the smmu allocation with devm_krealloc(), the allocation relocates and frees the original object, and a later failure causes the function to return NULL. The caller then follows its fallback path using the stale original pointer.
What is the practical impact of the bug?
The fallback path can dereference a freed smmu object, creating a use-after-free condition during probe/error handling. The fix ensures that both the caller and fallback path use the live reallocated pointer.
How can systems that cannot immediately update be mitigated?
The provided information does not identify a configuration workaround. Mitigation would require avoiding the affected probe/error path until a kernel containing the referenced fix is deployed.