Executive brief
The Linux kernel's Tegra241 NVIDIA GPU memory management controller driver (used in Grace servers) contains a use-after-free vulnerability in its probe routine. When memory reallocation fails during initialization, the driver's error handling attempts to clean up using a pointer that has already been freed, potentially allowing an attacker to trigger a kernel crash or code execution during device initialization.
Technical details
The vulnerability exists in the __tegra241_cmdqv_probe() function in drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c. When devm_krealloc() relocates memory to grow the smmu structure into a larger tegra241_cmdqv structure, it frees the original pointer. If devm_krealloc() fails and returns NULL, the caller's error handling path would attempt to dereference the original freed @smmu pointer. The fix changes the function signature to accept @smmu by reference (pointer-to-pointer) and updates the pointer in place upon successful reallocation, ensuring error paths use the live pointer. The vulnerability is triggered on systems with Tegra241 hardware during driver initialization, and requires the system to attempt krealloc reallocation (no special attacker interaction beyond device attachment).
Affected products
- Linux Linux kernel via iommu/arm-smmu-v3 Tegra241 support added in commit 918eb5c856f6
Timeline
- 2026-09-17: disclosed
- 2026-07-28: patched: upstream commit d4d05f55e9da646ec03adfa77260eb46f4163749
- 2026-09-14: patched: stable tree commit 86197679b293f0601c3331d545f99a70a7780aa9