Executive brief
The Linux kernel's NVIDIA Tegra241 IOMMU command queue driver has a race condition during device removal that could cause a kernel crash or memory corruption. When the device is removed, the interrupt handler may attempt to access freed memory structures if an IRQ fires after VINTF resources are torn down but before the IRQ is disabled. This affects systems using Tegra241 NVIDIA GPUs with the ARM SMMUv3 IOMMU.
Technical details
This is a use-after-free vulnerability in the tegra241_cmdqv_remove() function within the ARM SMMUv3 IOMMU driver. The vulnerable code path tears down VINTF (Virtual Interface) resources first, which frees vintf0 and clears cmdqv->vintfs[0], and only then calls free_irq(). If an error IRQ fires during the window between VINTF teardown and IRQ release, the tegra241_cmdqv_isr() interrupt handler will read a stale pointer and attempt to dereference NULL or already-freed memory in tegra241_vintf0_handle_error(). The fix reorders the operations to call free_irq() before tearing down VINTFs, ensuring the ISR cannot observe VINTF structures as they are being freed. The patch has been merged and is available in current Linux kernel stable trees.
Affected products
- Linux Linux kernel Multiple versions containing tegra241_cmdqv (introduced in commit 918eb5c856f6)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-09-14: patched: Patch merged into stable tree by Greg Kroah-Hartman