Linux kernel Tegra241 CMDQV: SMMU probe failure dereferences the freed smmu struct

Impact

__tegra241_cmdqv_probe() uses devm_krealloc() to grow the arm-smmu-v3 @smmu structure into the larger tegra241_cmdqv, which frees the original allocation once it relocates. A failure after that point returned NULL and the caller's fallback path then dereferenced the freed @smmu - a use-after-free in the IOMMU driver for the Tegra241 command queue virtualization extension, the SMMU front end on NVIDIA Grace-based systems. It is reached only when CMDQV probe fails after the realloc, during SMMU initialization at boot, so there is no tenant-facing attack path; the consequence is corrupt state or a crash while the IOMMU - the thing that isolates device DMA - is being set up. Operators of Grace/Grace-Hopper nodes should treat this as a boot-robustness fix rather than an exploitable hole.

Who can reach it

Local, boot-time, no attacker-controlled input identified in the record. The flaw is on an error path inside SMMU probe on Tegra241 hardware; CVSS is scored AV:L/AC:H/PR:N, consistent with a condition that requires a probe failure rather than a reachable trigger.

What to do

Update to a stable kernel carrying the fix, which returns an int and updates *smmu to the reallocated pointer (four stable commits are linked; no fixed release is named in the record). Kernel change on affected Grace-class nodes: drain the node and reboot. There is no runtime mitigation - the code runs before any workload is scheduled.

References

Related entries

• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High
• Linux kernel (arch/x86/kvm/vmx): With adaptive PEBS exposed, KVM never guaranteed that LBR MSRs held guest valuesCVE-2024-26992 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel (drivers/gpu/drm/nouveau): When the device-to-host copy behind a page fault silently fails, the faultCVE-2024-50096 · Linux kernel (drivers/gpu/drm/nouveau)High
• Linux kernel (uvcvideo): Out-of-bounds write parsing UVC_VS_UNDEFINED frames - exploited in the wildCVE-2024-53104 · Linux kernel (uvcvideo)High
• Intel ice driver (Ethernet 800 Series, Linux kernel mode): Kernel-mode flaw in the 800-series Ethernet Linux driver (anCVE-2025-23241 · Intel ice driver (Ethernet 800 Series, Linux kernel mode)High
• QEMU Guest Agent: symlink and TOCTOU flaws in SSH key injection give root inside the guestCVE-2026-12080 · QEMU Guest Agent (qga) guest-ssh-add-authorized-keys handlerHigh