CVE-2026-90427iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.
- CVSS
- 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 builds before 268cbe3a36ae57a2ec09601f343b92f6f092d505; from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 before 86197679b293f0601c3331d545f99a70a7780aa9; from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 before d4d05f55e9da646ec03adfa77260eb46f4163749 | CNA record |
References
- https://git.kernel.org/stable/c/268cbe3a36ae57a2ec09601f343b92f6f092d505
- https://git.kernel.org/stable/c/86197679b293f0601c3331d545f99a70a7780aa9
- https://git.kernel.org/stable/c/d4d05f55e9da646ec03adfa77260eb46f4163749
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.