CVE-2026-90425 (GCVE-0-2026-90425)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:09 – Updated: 2026-10-19 09:03
VLAI
Title
iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Reject the mapping with -EOPNOTSUPP if master->num_streams is not one.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6641 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 , < 9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5 (git)
Affected: 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 , < 0b139ec4641c7d4163d8e345c26cc630e24fa43b (git)
Affected: 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 , < fb292bfc9be936dade7eef7ec5762de1201983d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5",
              "status": "affected",
              "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
              "versionType": "git"
            },
            {
              "lessThan": "0b139ec4641c7d4163d8e345c26cc630e24fa43b",
              "status": "affected",
              "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
              "versionType": "git"
            },
            {
              "lessThan": "fb292bfc9be936dade7eef7ec5762de1201983d8",
              "status": "affected",
              "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID\n\ntegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID\ntaken from master-\u003estreams[0], and only warns when the device does not have\nexactly one stream. A device with several streams gets only its first one\nmapped, so a guest vSID invalidation cannot reach the others\u0027 ATC and IOTLB\nentries; a device with none makes master-\u003estreams a ZERO_SIZE_PTR, read out\nof bounds.\n\nReject the mapping with -EOPNOTSUPP if master-\u003enum_streams is not one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - tegra241_vintf_init_vsid() is reached only via iommufd_fops_ioctl() dispatching IOMMU_VDEVICE_ALLOC to iommufd_vdevice_alloc_ioctl() after VFIO_DEVICE_BIND_IOMMUFD. master-\u003enum_streams comes from the bound device\u0027s IORT/DT fwspec, not from a network protocol message.\nAC:L - Once a CMDQV master is bound, IOMMU_VDEVICE_ALLOC always does writel(master-\u003estreams[0].id, SID_REPLACE). pci_for_each_dma_alias (iort_pci_iommu_init) yields num_streams\u003e1 and maps only the first SID; num_streams==0 reads ZERO_SIZE_PTR. The attacker issues that ioctl; no race or uninfluenced layout is required.\nPR:L - iommufd_fops_open() and iommufd_vdevice_alloc_ioctl() have no capable() check (/dev/iommu 0660). A tenant or unprivileged QEMU user granted VFIO access on NVIDIA Grace can VFIO_DEVICE_BIND_IOMMUFD, IOMMU_VIOMMU_ALLOC type TEGRA241_CMDQV, and IOMMU_VDEVICE_ALLOC without init-namespace root.\nUI:N - The attacker opens iommufd, binds the assigned device, allocates the TEGRA241_CMDQV vIOMMU and vDEVICE, then issues guest ATC_INV on the mmap\u0027d VCMDQ themselves. No separate victim action such as mounting a filesystem is required.\nS:C - tegra241_vintf_init_vsid() programs SID_REPLACE/SID_MATCH only for master-\u003estreams[0], so CMDQV HW rewrite of guest ATC_INV (no VMEXIT) and arm_vsmmu_cache_invalidate cannot reach the other streams\u0027 ATC/IOTLB. That is an IOMMU/DMA boundary bypass: stale translations let device DMA reach host memory outside the guest domain.\nC:H - After a guest IOVA unmap, stale ATC/IOTLB entries on the unprogrammed physical SIDs let the passthrough device DMA-read recycled host pages. That is an arbitrary host-memory disclosure through the IOMMU, not a bounded kernel-pointer leak.\nI:H - The same stale translations allow DMA writes into recycled host pages, and programming only one of several SIDs leaves ATC_INV operating on the wrong Stream ID, corrupting IOMMU translation state with an arbitrary write suitable for control-flow hijack.\nA:H - When fwspec-\u003enum_ids is 0, arm_smmu_insert_master() sets master-\u003estreams to ZERO_SIZE_PTR ((void *)16) and tegra241_vintf_init_vsid() dereferences streams[0].id, which slab.h documents as a distinct access fault/oops; missed invalidations also let hostile DMA panic the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:03:29.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b139ec4641c7d4163d8e345c26cc630e24fa43b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb292bfc9be936dade7eef7ec5762de1201983d8"
        }
      ],
      "title": "iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90425",
    "datePublished": "2026-09-17T16:09:47.810Z",
    "dateReserved": "2026-09-11T19:38:34.814Z",
    "dateUpdated": "2026-10-19T09:03:29.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90425",
      "date": "2026-11-14",
      "epss": "0.00173",
      "percentile": "0.06863"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5",
                    "status": "affected",
                    "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0b139ec4641c7d4163d8e345c26cc630e24fa43b",
                    "status": "affected",
                    "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb292bfc9be936dade7eef7ec5762de1201983d8",
                    "status": "affected",
                    "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID\n\ntegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID\ntaken from master-\u003estreams[0], and only warns when the device does not have\nexactly one stream. A device with several streams gets only its first one\nmapped, so a guest vSID invalidation cannot reach the others\u0027 ATC and IOTLB\nentries; a device with none makes master-\u003estreams a ZERO_SIZE_PTR, read out\nof bounds.\n\nReject the mapping with -EOPNOTSUPP if master-\u003enum_streams is not one."
          }
        ],
        "id": "CVE-2026-90425",
        "lastModified": "2026-10-19T09:19:36.810",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:47.207",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b139ec4641c7d4163d8e345c26cc630e24fa43b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb292bfc9be936dade7eef7ec5762de1201983d8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:43:38+00:00",
      "cve": "CVE-2026-90425",
      "id": "CVE-2026-90425",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "110",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90425.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.