CVE-2026-80818

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. This vulnerability, a use-after-free, occurs when the system attempts to deinitialize a virtual interface during device teardown, accessing memory that has already been released. A local attacker or a malicious device could exploit this to trigger a kernel panic, leading to a system crash and a Denial of Service (DoS).

CMD_SYNC use-after-free can occur in the Tegra241 CMDQV teardown path because VINTF deinit may issue a command after the SMMU command queue has already been freed during devres unwind or device unbind. This can lead to an invalid access in arm_smmu_cmdq_issue_cmdlist and crash the kernel. For the CVSS the PR:L is used for the paranoid score because the iommufd viommu destroy path and delegated device management can be reachable by a local VMM or service account with limited device access rather than full host admin rights. The issue is not network reachable and requires local device or virtualization control on systems with Tegra241 CMDQV support. Impact is at least local denial of service and in worst case may allow confidentiality or integrity impact due to a kernel use-after-free memory corruption scenario.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.