CVE-2026-90426

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv component. During the teardown process of Virtual Interrupt Functions (VINTFs), the error interrupt (IRQ) is freed after the VINTFs are torn down. This incorrect order can lead to a scenario where an error occurring in this window causes the system to attempt to access a freed or null pointer. Consequently, this can result in memory corruption, leading to system instability or a denial of service.

This vulnerability is evaluated as having a Moderate severity for Red Hat Enterprise Linux because exploitation requires local access on systems featuring specific NVIDIA Tegra241 hardware, and the potential impact is limited to a system crash. The issue occurs due to an incorrect teardown order in the Tegra241 SMMU command queue driver where error interrupt handlers remain active while virtual interfaces are deallocated. Environments without this specialized ARM-based hardware architecture are not exposed to this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.