Linux iommu/tegra241-cmdqv: multi-stream devices get incomplete vSID mapping, zero-stream devices read out of bounds

Impact

tegra241_vintf_init_vsid() mapped a guest vSID to master->streams[0] while only warning if the device did not have exactly one stream. A device with several streams got only its first one mapped, so guest-issued vSID invalidations never reached the ATC and IOTLB entries of the others - stale IOMMU translations surviving a guest's invalidation, which breaks the isolation guarantee virtualized SMMU command queues exist to provide. A device with no streams made master->streams a ZERO_SIZE_PTR that was then read out of bounds. This is the Grace/Tegra241 CMDQ-V path, so it matters on NVIDIA Grace-based nodes that pass accelerators or NICs into guests; it is not reachable on x86 hosts or without the tegra241-cmdqv driver in use.

Who can reach it

Local, privileged: the host path that sets up a virtualized SMMU command-queue interface for a guest - device assignment to a VM on a Grace/Tegra241 host. Not reachable by an ordinary tenant without device-passthrough rights, and not reachable at all on hardware without this IOMMU.

What to do

Take the stable kernel containing the fix (mapping is now rejected with -EOPNOTSUPP unless master->num_streams is exactly one) and reboot affected Grace/Tegra241 nodes; drain each before rebooting. No runtime mitigation other than not assigning multi-stream devices into guests on these hosts.

References

Related entries

• Linux dw-edma: callbacks fire for terminated transfers, dereferencing freed client stateCVE-2026-93042 · Linux kernel dmaengine dw-edma (terminate-all descriptor handling)High
• QEMU 9pfs: use-after-free race between Tlcreate and Twalk lets a guest escape the shared directory to host filesCVE-2026-93834 · QEMU 9pfs (virtio-9p shared directory, Tlcreate/Twalk race)High
• Linux kernel nvme-fc: error recovery iterates an uninitialized IO tagset when admin connect times outCVE-2026-97409 · Linux kernel nvme-fc (requests cancelled in an uninitialized IO tagset during CONNECTING error recovery)High
• Linux kernel qla2xxx: unserialized NVMe-FC unsolicited-context list can be corrupted by concurrent add and deleteCVE-2026-97527 · Linux kernel scsi qla2xxx (fcport->unsol_ctx_head list unserialized across ISR, DPC and NVMe-FC callbacks)High
• Linux kernel qla2xxx: NVMe-FC unsolicited context freed while still linked, leaving a freed node on the listCVE-2026-97528 · Linux kernel scsi qla2xxx (uctx freed without list_del() on qla_nvme_xmt_ls_rsp() error path)High
• Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroedCVE-2021-47136 · Linux kernel mlx5_core representor TC path + net/sched tc extensionHigh