From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D84550E5A9 for ; Thu, 17 Sep 2026 16:31:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662670; cv=none; b=o1bF9wMofnssRm3BxTMGT0Pxc4wm5Ra0LLQMltCNkO0msYvdON1K+F28YUSBJETDZoZWU3vB0irUCpNf+h1ZeSmVsqGzZ07fSJZdUi8ABjo8VL8aIYWZRDuvAv27kgVyNyghWOEiNCLHKHygKc/5B8M3W2YwePG98XypdhE+2qw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662670; c=relaxed/simple; bh=Y0YcUMBSQfX+vUX7Uo+tFr2BTOiFiyWEp7QZOahyUZ0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TSM2uCvvsu9kmQilVirpj+oHcWr6Cttr+hxUQO3KSPvCsgD1BCOPGEGunWi8vP5b9H3MYuAU4jgCwTEcKjci8rfS2zyupGN83maYrfIeDlWdIQ7Oimssae/fsUIlqNy9V/2J6y67iADd7dQBwfokEfTHilVTcScYw1/tsi4VvNM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rieXBlvT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rieXBlvT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 787F41F000FF; Thu, 17 Sep 2026 16:31:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662668; bh=VUi2T/nyfyq4YqdRxQOoP6DWWNtkNfvoE/58+Sfkuuc=; h=From:To:Cc:Subject:Date:Reply-To; b=rieXBlvT+2FUG8YKwDt5w/pQtuy8OddhFxM+yaGBZ0gjy9eA9giUN6LSxHhMEuvYg TOa7QP4sv0yqCMKOq7dTx1LYGwHOwRw/zuMGUSCjeIumB/FMFRcftXrI+K3qVwLjvi D4DPAxyWDKz//Mf/EbkIJOxU7tIQvDqF36lWomJM= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90429: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init Date: Thu, 17 Sep 2026 17:14:19 +0100 Message-ID: <2026091720-CVE-2026-90429-e2b8@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3672; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=bFvwk9kO7VoRPDGWWjYDiI87N+aTYaD3+YlCX8eJPgs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBDZcsdo9O8+ANeeR0Ps7UQ7NinKTnIXaP3+SVNp7a FVF5ce2jlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhIcg3DgiVWKaaLJryOM/Rn M+srjJl05MOptQzz47ue6+1u572/6Cirz4ztn73LhHjiAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init A user VINTF is torn down by tegra241_cmdqv_deinit_vintf(), which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the cmdqv->vintfs[] slot and lets the iommufd core free it, but nothing serializes that against the error interrupt: tegra241_cmdqv_isr() reads cmdqv->vintfs[idx] and dereferences the vintf. A concurrent error can make the ISR read a slot mid-clear (a NULL deref) or use a vintf which is about to be freed (a use-after-free). deinit_vintf() also returns idx to the IDA before clearing the slot, so a concurrent create that reuses idx can publish its new vintf into the slot, only for this teardown to erase it again with the stale NULL store. On the other end, tegra241_cmdqv_init_vintf() publishes a new vintf with a plain store to the cmdqv->vintfs[] slot, and the ISR dereferences fields of a published vintf such as vintf->base. A plain store gives no ordering on a weakly-ordered CPU, and a stale VINTF_ERR_MAP bit on a reused idx can make the ISR pick a vintf the moment it is published, before its fields are set or tegra241_vintf_hw_init() runs. The cmdqv->vintfs[0] slot stays NULL until tegra241_cmdqv_init_structures() first creates VINTF0, so the slot 0 read needs the same NULL check. Publish every slot with an smp_store_release(), and read each slot in the ISR with an smp_load_acquire() under a NULL check, so the ISR always sees a fully built vintf or NULL. Also make deinit_vintf() clear the slot, and synchronize_irq() prior to returning idx to the IDA, so no vintf is freed under a running handler and no reused idx is clobbered. The Linux kernel CVE team has assigned CVE-2026-90429 to this issue. Affected and fixed versions =========================== Issue introduced in 6.17 with commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 and fixed in 6.18.52 with commit bcb82407633c3008362ad927699d985ee4981557 Issue introduced in 6.17 with commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 and fixed in 7.2.6 with commit f3ef4abc271a1d3d7b6715879e149c286dc8aae7 Issue introduced in 6.17 with commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 and fixed in 7.3-rc1 with commit a491be376abd1c80a314cdd658632c85cd660b73 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90429 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/bcb82407633c3008362ad927699d985ee4981557 https://git.kernel.org/stable/c/f3ef4abc271a1d3d7b6715879e149c286dc8aae7 https://git.kernel.org/stable/c/a491be376abd1c80a314cdd658632c85cd660b73