Executive brief
The Linux kernel's IOMMU driver for NVIDIA Tegra241 Grace processors contained a race condition in error handling. A command queue (LVCMDQ) was made visible to the error interrupt handler before its internal structures were fully initialized. If a latched hardware error occurred during initialization—particularly after a kernel reboot (kexec)—the error handler would attempt to access NULL pointers, causing a kernel crash and denial of service.
Technical details
The vulnerability is a use-before-initialization race condition in the Tegra241 CMDQV (command queue virtualization) IOMMU driver. The function tegra241_vintf_init_lvcmdq() published a virtual command queue (vcmdq) pointer to a shared array before tegra241_vcmdq_alloc_smmu_cmdq() had finished initializing the vcmdq→cmdq structure. The error interrupt service routine (ISR) tegra241_vintf0_handle_error() could be triggered by latched hardware errors (e.g., inherited across kexec) and would dereference the unpopulated cmdq, causing NULL pointer dereference in __arm_smmu_cmdq_skip_err(). The fix delays publication of the vcmdq until after full initialization, using smp_store_release() and smp_load_acquire() barriers to ensure the ISR sees either a fully initialized LVCMDQ or NULL.
Affected products
- Linux Linux kernel versions affected by Tegra241 CMDQV driver (introduced in kernel with commit 918eb5c856f6)
Timeline
- 2026-09-17: disclosed: CVE-2026-90430 published
- 2026-07-14: patched: Fix committed by Nicolin Chen
- 2026-09-14: other: Backported to stable trees by Sasha Levin