CVE-2026-90425
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Reject the mapping with -EOPNOTSUPP if master->num_streams is not one.
How to fix
- Linux Linux9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5, 0b139ec4641c7d4163d8e345c26cc630e24fa43b, fb292bfc9be936dade7eef7ec5762de1201983d8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 ≤ v < 9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5, 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 ≤ v < 0b139ec4641c7d4163d8e345c26cc630e24fa43b, 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 ≤ v < fb292bfc9be936dade7eef7ec5762de1201983d8, 6.17 | 9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5, 0b139ec4641c7d4163d8e345c26cc630e24fa43b, fb292bfc9be936dade7eef7ec5762de1201983d8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.