Executive brief
The Linux kernel's Tegra 241 IOMMU command queue interface has an input validation flaw in its virtual Stream ID (vSID) processing. A guest VM can supply an oversized vSID value that gets silently truncated, causing it to incorrectly match against a different Stream ID and accessing resources it should not. This could allow a malicious guest to bypass isolation boundaries and access other VMs' memory or I/O devices.
Technical details
The vulnerability is an input validation bypass in the tegra241_vintf_init_vsid() function within the ARM SMMUv3 IOMMU driver. The function accepts a guest-controlled virt_sid value and writes it to the SID_MATCH register, which has a 20-bit VIRT_SID field (bits [20:1]). The original code only checked if virt_sid exceeded UINT_MAX, which is insufficient. An attacker-controlled vSID value like 0x80000000 undergoes a bitwise shift operation (virt_sid << 1 | 0x1) that truncates bits above position 20, causing it to alias an unintended Stream ID. The fix adds proper bounds validation using FIELD_MAX() and uses FIELD_PREP() to safely encode the value into the register field. Exploitation requires the attacker to have the ability to specify a vSID when configuring a virtual device, which is possible from within a guest VM in a virtualization environment.
Affected products
- Linux Linux kernel Vulnerable versions include kernels containing commit 4dc0d12474f9 and prior to the fix in commit 4379610c79bd88ddbea10e7f6c21e16d4b338c6b
Timeline
- 2026-09-11: disclosed: Vulnerability published in NVD
- 2026-07-28: patched: Fix merged upstream in commit 4379610c79bd88ddbea10e7f6c21e16d4b338c6b