CVE-2026-90426

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq(). Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in that window makes tegra241_cmdqv_isr() read the stale slot and hand it to tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer. Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight handlers to finish and blocks new ones, so no ISR can observe a VINTF as it is torn down. Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches freed memory. This is neither introduced nor fixed here: a physical IOMMU is not a pluggable device, so iommufd by design holds no reference on the one behind a viommu, and this teardown is not expected while that viommu is still alive.

• https://git.kernel.org/stable/c/076a4f5b1fc2016b973a12bc2ebb9b730e5e1e48
• https://git.kernel.org/stable/c/421f5ab135cd4a1353891e5bf2602cfc3c01afc7
• https://git.kernel.org/stable/c/61f0d437988e5730b04442f6a7d30a9907339f2a
• https://git.kernel.org/stable/c/735698e81f798b4c02dcb6291ffbdd1b962c8c66

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90420In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90421In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90422In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90423In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90424In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90425In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-90427In the Linux kernel, the following vulnerability has been re…7.4
• CVE-2026-90428In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90429In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-90430In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90431In the Linux kernel, the following vulnerability has been re…
• CVE-2026-90432In the Linux kernel, the following vulnerability has been re…