Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-90425 Details

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Reject the mapping with -EOPNOTSUPP if master->num_streams is not one.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/0b139ec4641c7d4163d8e345c26cc630e24fa43b kernel.org
https://git.kernel.org/stable/c/9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5 kernel.org
https://git.kernel.org/stable/c/fb292bfc9be936dade7eef7ec5762de1201983d8 kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-90425
NVD Published Date:
Sep 17, 2026
NVD Last Modified:
Sep 18, 2026
Source:
kernel.org