UBUNTU-CVE-2026-90424: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241cmdqvinitstructures() allocates VINTF0 with kzallocobj(), inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241cmdqvinitvintf() fails it returns before VINTF0 reaches the cmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach it; free it directly there. A later VCMDQ preallocation failure instead leaves VINTF0 published, and so this time the unwind does reach tegra241cmdqvremovevintf(), which then frees it from vintf->hypown. But tegra241vintfhwinit() sets that flag only afterward, from a HW read-back, so the still-uninited VINTF0 reads as guest-owned and leaks, with mutexdestroy() and idadestroy() run on fields it never set up. Decide ownership from vintf->idx instead, the index assigned when its id is allocated: idx 0 is the kernel-owned VINTF0, while idx >= 1 marks a guest VINTF. So the in-kernel free decision in tegra241cmdqvremovevintf() and tegra241vintffreelvcmdq() now keys on idx too, and hypown stays a pure HW-readback state.