Executive brief
The Linux kernel's NVIDIA Tegra241 IOMMU Command Queue initialization contains a race condition where an error interrupt handler can execute before the data structures it accesses have been allocated. If an IOMMU device has a latched error and is reinitialized (kexec), the handler crashes when accessing an uninitialized array. The patch reorders initialization to allocate the array before enabling the interrupt.
Technical details
The vulnerability is a use-after-free / use-before-initialization race condition in the tegra241-cmdqv IOMMU driver's probe function. The __tegra241_cmdqv_probe() function requests the error IRQ handler before allocating and initializing the cmdqv->vintfs array and setting cmdqv->num_vintfs. If the CMDQV hardware has a latched error and the IRQ is requested, tegra241_cmdqv_isr() fires immediately and attempts to walk the uninitialized vintfs array, causing a kernel crash. The fix reorders probe initialization to allocate and zero cmdqv->vintfs before calling request_threaded_irq(), ensuring that if an early interrupt fires, the ISR safely skips over the NULL-initialized array slots.
Affected products
- Linux Linux kernel 5.x through 7.x (tegra241-cmdqv driver affected since introduction in kernel 6.2 or later based on fixes commit)
Timeline
- 2026-07-14: other: Fix authored by Nicolin Chen
- 2026-07-28: patched: Fix merged upstream (commit 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd)
- 2026-09-17: disclosed