CVE-2026-90427 PUBLISHED

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

Assigner: Linux
Reserved: 11.09.2026 Published: 17.09.2026 Updated: 17.09.2026

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path.

Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to 86197679b293f0601c3331d545f99a70a7780aa9 (excl.)
  • affected from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 to d4d05f55e9da646ec03adfa77260eb46f4163749 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.12 is affected
  • unaffected from 0 to 6.12 (excl.)
  • unaffected from 7.2.6 to 7.2.* (incl.)
  • unaffected from 7.3-rc1 to * (incl.)

References