CVE-2026-90427

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. During the __tegra241_cmdqv_probe() function, a memory reallocation operation can free an existing memory region. If this reallocation fails, a subsequent fallback path attempts to access the previously freed memory. This 'use-after-free' vulnerability can lead to system instability or a denial of service (DoS) condition.

A use-after-free can occur in the Tegra241 CMDQV SMMU probe path when devm_krealloc relocates the original smmu object and a later failure makes the caller fall back while still using the freed pointer. The fallback path can read fields from the stale smmu pointer and also update smmu options, so the impact is not limited to a simple warning and includes a constrained write to freed kernel memory. For the CVSS the PR:L is used for the paranoid score because a local user may be able to influence memory pressure and failure timing, while direct and reliable control of device probing usually needs administrative or platform control. The issue is not network reachable and requires a local system with NVIDIA Tegra241 CMDQV support. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.