CVE-2026-80818
Received Received - Intake

Use-After-Free in Linux Kernel IOMMU Tegra241 CMDQ

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown arm_smmu_impl_remove() is registered as a devres action in arm_smmu_impl_probe(), before arm_smmu_init_queues() allocates smmu->cmdq.q.base. On a devres unwind, whether a failed probe or an unbind, the queue is freed first and arm_smmu_impl_remove() then runs tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC on the freed memory. Observed during testing with a QEMU hack that makes the VCMDQ fail to enable, so the impl reset fails and probe aborts into the devres unwind: platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: uncleared error detected, resetting arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110 Unable to handle kernel paging request at virtual address ffff8000891e0098 ... Internal error: Oops: 0000000096000047 [#1] SMP ... Call trace: arm_smmu_cmdq_issue_cmdlist+0x320/0x6fc (P) tegra241_vcmdq_hw_deinit+0x98/0x168 tegra241_vintf_hw_deinit+0x5c/0x1b0 tegra241_cmdqv_remove_vintf+0x34/0xec tegra241_cmdqv_remove+0x40/0x9c arm_smmu_impl_remove+0x20/0x30 devm_action_release+0x14/0x20 devres_release_all+0xa8/0x110 device_unbind_cleanup+0x18/0x84 really_probe+0x1f0/0x29c Drop the VINTF deinit from tegra241_cmdqv_remove_vintf() so the unwind no longer touches the freed queue. Quiesce the VINTFs earlier instead. Add a device_disable() impl op and run it from arm_smmu_disable_action() while the CMDQ is still up. That handles a live unbind. A failed reset is already handled because tegra241_vintf_hw_init() deinits the VINTF on its own error path. tegra241_cmdqv_remove_vintf() is also used by the iommufd viommu destroy path, so quiesce there too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80818
EUVD
EUVD-2026-71253

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nvidia tegra241_cmdqv *
nvidia arm_smmu_v3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's IOMMU subsystem, specifically affecting the Tegra241 CMDQV driver. It occurs during device teardown when a command queue is freed before related cleanup operations complete, leading to a memory access error.

Detection Guidance

This vulnerability is specific to the Linux kernel's IOMMU subsystem, particularly with the Tegra241 CMDQV driver. Detection requires checking kernel logs for errors related to tegra241_cmdqv or arm_smmu_v3 during device initialization or unbind operations. Monitor for kernel oops messages or paging faults during system boot or driver unloading.

Impact Analysis

This vulnerability can cause system crashes or kernel panics when devices are unplugged or drivers fail to initialize. It may lead to denial-of-service conditions on affected systems using NVIDIA Tegra241 hardware with the IOMMU subsystem.

Mitigation Strategies

Apply the kernel patch that resolves this issue by updating to a version containing the fix. The patch removes the problematic VINTF deinit from tegra241_cmdqv_remove_vintf() and quiesces VINTFs earlier. Check your Linux distribution's security updates or kernel release notes for the patched version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart