Executive brief
A flaw in the Linux kernel's IOMMU driver for Tegra241 hardware could cause a system crash during device teardown or probe failure. When the device shuts down or fails to initialize, freed memory is accessed improperly, potentially leading to kernel instability or system hangs.
Technical details
The vulnerability is a use-after-free condition in the iommu/tegra241-cmdqv driver affecting ARM SMMU v3 implementations. The root cause is incorrect devres action ordering: arm_smmu_impl_remove() is registered before arm_smmu_init_queues() allocates smmu->cmdq.q.base, causing the queue memory to be freed before the remove handler runs. When tegra241_cmdqv_remove_vintf() attempts to issue a CMD_SYNC on the freed command queue during VINTF deinit, a kernel page fault occurs. The attack vector is local (triggered during probe failure or device unbind), and no authentication is required. The fix involves deferring VINTF deinit from the remove path and quiescing VINTFs earlier via a new device_disable() impl op. The patch has been provided in the kernel upstream.
Affected products
- Linux Linux kernel affects IOMMU Tegra241 driver, exact version range not specified in advisory
Timeline
- 2026-09-04: disclosed: CVE-2026-80818 published