CVE-2026-90428
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips.
How to fix
- Linux Linuxb1605a56745f22670205f6561df5771bbbb62a99, 2f627118b668659c6b195ac48beedb1bf8f53368, a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d, 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < b1605a56745f22670205f6561df5771bbbb62a99, 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < 2f627118b668659c6b195ac48beedb1bf8f53368, 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d, 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 ≤ v < 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd, 6.12 | b1605a56745f22670205f6561df5771bbbb62a99, 2f627118b668659c6b195ac48beedb1bf8f53368, a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d, 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.