iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (CVE-2026-90426) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-90426

iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs

Answer in brief

CVE-2026-90426 records a Unknown severity vulnerability in iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 17, 2026Source checked Sep 17, 2026First seen by HOL Sep 17, 2026Material review Sep 17, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=918eb5c856f6ce4cf93b4b38e4b5e156905c5943 <076a4f5b1fc2016b973a12bc2ebb9b730e5e1e48 \|\| >=918eb5c856f6ce4cf93b4b38e4b5e156905c5943 <735698e81f798b4c02dcb6291ffbdd1b962c8c66 \|\| >=918eb5c856f6ce4cf93b4b38e4b5e156905c5943 <421f5ab135cd4a1353891e5bf2602cfc3c01afc7 \|\| >=918eb5c856f6ce4cf93b4b38e4b5e156905c5943 <61f0d437988e5730b04442f6a7d30a9907339f2a	076a4f5b1fc2016b973a12bc2ebb9b730e5e1e48, 735698e81f798b4c02dcb6291ffbdd1b962c8c66, 421f5ab135cd4a1353891e5bf2602cfc3c01afc7, 61f0d437988e5730b04442f6a7d30a9907339f2a
Linux/Linuxgeneric	6.12	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 076a4f5b1fc2016b973a12bc2ebb9b730e5e1e48 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 17, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq(). Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in that window makes tegra241_cmdqv_isr() read the stale slot and hand it to tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer. Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight handlers to finish and blocks new ones, so no ISR can observe a VINTF as it is torn down. Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches freed memory. This is neither introduced nor fixed here: a physical IOMMU is not a pluggable device, so iommufd by design holds no reference on the one behind a viommu, and this teardown is not expected while that viommu is still alive.

Quoted source text, attributed separately from HOL analysis.