CVE-2026-89450

Received Received - Intake

Buffer Overflow in Linux Kernel IOMMU Command Queue

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, which admits a value far wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it. Validate virt_sid against the field width with FIELD_MAX(), and program the register with FIELD_PREP() so the value and the field stay consistent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89450

EUVD

EUVD-2026-76356

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of a virtual Stream ID (vSID) in the Tegra241 IOMMU command queue. The issue occurs when a guest-controlled vSID is wider than the hardware's SID_MATCH field, which only supports 20 bits. The current check only rejects values exceeding UINT_MAX, allowing excessively wide vSIDs. When written to hardware, bits beyond the 20th are dropped, causing incorrect Stream ID matching and potential aliasing to unintended vSIDs.

Detection Guidance

This vulnerability is specific to the Linux kernel's Tegra241 IOMMU command queue implementation. Detection requires checking the kernel version and examining the vulnerable function tegra241_vintf_init_vsid(). No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow a malicious guest VM to manipulate memory access permissions by aliasing to incorrect Stream IDs. This might enable unauthorized access to memory regions or devices assigned to other VMs, potentially leading to data breaches, privilege escalation, or denial-of-service conditions in systems using affected Linux kernels.

Mitigation Strategies

Apply the Linux kernel patch that validates virt_sid against the field width using FIELD_MAX() and programs the register with FIELD_PREP(). Update to a kernel version containing this fix or backport the patch to your current kernel.

Hi! I’m here to help you understand CVE-2026-89450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70