CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
tegra241vintfinitlvcmdq() stores the freshly allocated vcmdq pointer to the vintf->lvcmdqs[] array, before tegra241vcmdqallocsmmucmdq() builds the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ error (e.g. one inherited across a kexec) firing in this window would make tegra241vintf0handleerror() pass the still-zeroed armsmmucmdq down to armsmmucmdqskiperr(), dereferencing NULL queue register pointers.
Drop the store from tegra241vintfinitlvcmdq() and publish the vcmdq at the end of the allocation instead, with an smpstorerelease() that pairs with an smploadacquire() in the ISR, which can see a fully built LVCMDQ or NULL.
The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq once tegra241vcmdqhwinituser() succeeds, using a plain store since a user VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks the VINTF0 array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In tegra241_vintf_init_lvcmdq(), remove the early store to vintf->lvcmdqs[] and publish the VINTF0 vcmdq only after tegra241_vcmdq_alloc_smmu_cmdq() has fully built it, using smp_store_release() paired with smp_load_acquire() in the ISR. For user-owned LVCMDQ allocation, publish the vcmdq only after tegra241_vcmdq_hw_init_user() succeeds, using a plain store because user VINTF lvcmdqs[] has no lockless reader.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue affects Linux kernel systems using the Tegra241 CMDQv IOMMU path, specifically during LVCMDQ initialization where the VINTF0 error ISR can inspect the LVCMDQ array.
What condition triggers the failure?
An LVCMDQ error must fire after the newly allocated queue pointer is published but before its underlying SMMU command queue has been initialized. The description identifies a latched LVCMDQ error inherited across a kexec as an example.
How would the failure appear?
The VINTF0 error handler can pass a zero-initialized arm_smmu_cmdq to the command-queue error handling path, causing a NULL dereference of queue register pointers.