CVE-2026-90425

A flaw was found in the Linux kernel, specifically within the IOMMU (Input/Output Memory Management Unit) Tegra241 command queue driver. This vulnerability arises from improper handling of virtual Stream IDs (vSID) when a device has either multiple or no physical Stream IDs. A malicious guest operating system could exploit this to trigger an out-of-bounds read, which may lead to a system crash (Denial of Service) or the disclosure of sensitive information.

tegra241 CMDQV vSID setup accepted devices whose physical Stream ID count was not exactly one. For a multi stream device, only master streams 0 was mapped, so guest vSID invalidation could miss ATC and IOTLB entries belonging to the other streams and leave stale DMA translations active. For a device with zero streams, master streams may be a ZERO_SIZE_PTR and reading master streams 0 can become an out of bounds read or invalid kernel access. For the CVSS the PR:L is used because reliable triggering normally requires a local process with access to iommufd or delegated device assignment controls, but this is not necessarily full host administrator privilege in virtualized or service managed environments. The issue is not network reachable. Impact is at least local denial of service via invalid access, and the paranoid score treats the stale IOMMU translation case as possible confidentiality and integrity impact due to DMA isolation failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.