CVE-2026-90427

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90427
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90427.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90427
Downstream
Related
Published
2026-09-17T16:09:49Z
Modified
2026-10-28T02:30:54Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
Details

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()

__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path.

Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90427.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
918eb5c856f6ce4cf93b4b38e4b5e156905c5943
Fixed
ea2edb27ef2648d8687cd0fc3ec3ba1793436e7e
Fixed
268cbe3a36ae57a2ec09601f343b92f6f092d505
Fixed
86197679b293f0601c3331d545f99a70a7780aa9
Fixed
d4d05f55e9da646ec03adfa77260eb46f4163749

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90427.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.12.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.57
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90427.json"