CVE-2026-90427

HIGH 7.4

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.

Vendor	linux
Product	linux
Ecosystems	Linux Kernel
Industries	Technology
Published	Sep 17, 2026
Last Updated	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for linux linux

Be the first to know when new high vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Linux / Linux

918eb5c856f6ce4cf93b4b38e4b5e156905c5943 < ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 < 268cbe3a36ae57a2ec09601f343b92f6f092d505 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 < 86197679b293f0601c3331d545f99a70a7780aa9 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 < d4d05f55e9da646ec03adfa77260eb46f4163749

Linux / Linux

6.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

git.kernel.org: https://git.kernel.org/stable/c/ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e git.kernel.org: https://git.kernel.org/stable/c/268cbe3a36ae57a2ec09601f343b92f6f092d505 git.kernel.org: https://git.kernel.org/stable/c/86197679b293f0601c3331d545f99a70a7780aa9 git.kernel.org: https://git.kernel.org/stable/c/d4d05f55e9da646ec03adfa77260eb46f4163749