In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

__tegra241_cmdqv_probe() requests the error IRQ before it has allocated the
cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a
latched error across a kexec fires the IRQ as soon as it is requested, and
tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array.

Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that
a latched interrupt firing early runs the ISR against a valid array of NULL
slots that it safely skips.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
918eb5c856f6ce4cf93b4b38e4b5e156905c5943 affected < b1605a56745f22670205f6561df5771bbbb62a99
918eb5c856f6ce4cf93b4b38e4b5e156905c5943 affected < 2f627118b668659c6b195ac48beedb1bf8f53368
918eb5c856f6ce4cf93b4b38e4b5e156905c5943 affected < a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d
918eb5c856f6ce4cf93b4b38e4b5e156905c5943 affected < 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd
Linux Linux affected
Version Status Constraints
6.12 affected —
0 unaffected < 6.12
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2f627118b668659c6b195ac48beedb1bf8f53368 cve-icon cve-icon
https://git.kernel.org/stable/c/5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd cve-icon cve-icon
https://git.kernel.org/stable/c/a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d cve-icon cve-icon
https://git.kernel.org/stable/c/b1605a56745f22670205f6561df5771bbbb62a99 cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips.
Title iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:09:49.783Z

Reserved: 2026-09-11T19:38:34.814Z

Link: CVE-2026-90428

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:47.643

Modified: 2026-09-17T17:17:47.643

Link: CVE-2026-90428

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.