UBUNTU-CVE-2026-90430: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241vintfinitlvcmdq() stores the freshly allocated vcmdq pointer to the vintf->lvcmdqs[] array, before tegra241vcmdqallocsmmucmdq() builds the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ error (e.g. one inherited across a kexec) firing in this window would make tegra241vintf0handleerror() pass the still-zeroed armsmmucmdq down to armsmmucmdqskiperr(), dereferencing NULL queue register pointers. Drop the store from tegra241vintfinitlvcmdq() and publish the vcmdq at the end of the allocation instead, with an smpstorerelease() that pairs with an smploadacquire() in the ISR, which can see a fully built LVCMDQ or NULL. The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq once tegra241vcmdqhwinituser() succeeds, using a plain store since a user VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks the VINTF0 array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In tegra241_vintf_init_lvcmdq(), do not store the freshly allocated vcmdq in vintf->lvcmdqs[] before tegra241_vcmdq_alloc_smmu_cmdq() builds it. Publish the fully initialized vcmdq at the end with smp_store_release(), and have the error ISR use smp_load_acquire() so it observes either a fully built LVCMDQ or NULL. For user-owned LVCMDQ allocation, publish with a plain store only after tegra241_vcmdq_hw_init_user() succeeds.
Event History
Frequently Asked Questions
What conditions can trigger the fault?
A latched LVCMDQ error must be handled while an LVCMDQ is being initialized but before its command queue is built. The description specifically identifies an error inherited across a kexec as an example of an error that could fire in this window.
What is the impact when the race occurs?
The VINTF0 error ISR can pass a still-zeroed arm_smmu_cmdq to the error-handling path. That path dereferences NULL queue register pointers.
Does the lockless error-ISR path apply to user VINTFs?
No. The error ISR only walks the VINTF0 LVCMDQ array; a user VINTF's lvcmdqs[] array has no lockless reader.
Which Ubuntu kernel package variants are listed for this CVE?
The listed variants are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws.