Executive brief
The Linux kernel's IOMMU driver for NVIDIA Tegra241 processors contains a flaw in virtual Stream ID (vSID) initialization that can cause system crashes or data corruption. When a device does not have exactly one Stream ID, the driver either reads memory outside valid bounds or fails to invalidate all necessary cache entries, potentially allowing unintended access to protected memory regions or causing denial of service.
Technical details
The vulnerability exists in the tegra241_vintf_init_vsid() function within drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c. The function maps a guest virtual Stream ID to a physical Stream ID by accessing master->streams[0], but only issued a warning if the device did not have exactly one stream. This creates two attack scenarios: (1) a device with multiple streams gets only the first one mapped, causing vSID invalidation operations to miss other ATC and IOTLB entries, and (2) a device with zero streams causes master->streams to become a ZERO_SIZE_PTR, leading to out-of-bounds memory reads. The fix changes the warning to an explicit check that rejects the mapping with -EOPNOTSUPP if master->num_streams is not exactly one. No authentication or user interaction is required; the vulnerability can be triggered by kernel-mode code path execution, making it a local privilege escalation or denial-of-service vector on systems using affected Tegra241 IOMMU configurations.
Affected products
- Linux Linux kernel 5.15 through 6.12 and later (IOMMU subsystem in arm-smmu-v3/tegra241-cmdqv)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-09-14: patched: Patch committed to Linux stable tree by Greg Kroah-Hartman