Executive brief
The Linux kernel's Tegra 241 IOMMU command queue controller contains a race condition in interrupt handling that can lead to null pointer dereferences or use-after-free access. This vulnerability occurs when the interrupt handler reads memory that is being simultaneously torn down by kernel code, potentially causing system crashes or allowing kernel code execution.
Technical details
The vulnerability is a race condition / synchronization bug in the iommu/tegra241-cmdqv driver. The error ISR (tegra241_cmdqv_isr()) reads from the cmdqv->vintfs[] array without proper synchronization against concurrent VINTF initialization and teardown operations. Specifically: (1) tegra241_cmdqv_deinit_vintf() clears array slots without synchronizing against the ISR, leading to NULL dereference or use-after-free; (2) tegra241_cmdqv_init_vintf() publishes new VINTFs with plain stores that lack ordering guarantees on weakly-ordered CPUs, allowing the ISR to read partially-initialized structures; (3) slot 0 is not NULL-checked before dereference. The fix employs smp_store_release() for publishing VINTFs, smp_load_acquire() for ISR reads with NULL checks, and synchronize_irq() barriers during teardown. Attack vector is local (kernel driver bug); no network or user authentication required. The issue can cause denial of service (crash) or potentially privilege escalation via kernel code paths.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed