CVE-2026-90427
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.
How to fix
- Linux Linuxea2edb27ef2648d8687cd0fc3ec3ba1793436e7e, 268cbe3a36ae57a2ec09601f343b92f6f092d505, 86197679b293f0601c3331d545f99a70a7780aa9, d4d05f55e9da646ec03adfa77260eb46f4163749 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e, 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < 268cbe3a36ae57a2ec09601f343b92f6f092d505, 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < 86197679b293f0601c3331d545f99a70a7780aa9, 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < d4d05f55e9da646ec03adfa77260eb46f4163749, 6.12 | ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e, 268cbe3a36ae57a2ec09601f343b92f6f092d505, 86197679b293f0601c3331d545f99a70a7780aa9, d4d05f55e9da646ec03adfa77260eb46f4163749 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.