{"id":17322,"date":"2026-09-05T02:30:59","date_gmt":"2026-09-04T18:30:59","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80818"},"modified":"2026-09-05T02:30:59","modified_gmt":"2026-09-04T18:30:59","slug":"cve-2026-80818","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80818","title":{"rendered":"CVE-2026-80818 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\niommu\/tegra241-cmdqv:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>iommu\/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown<\/p>\n<p>arm_smmu_impl_remove() is registered as a devres action in<br \/>\narm_smmu_impl_probe(), before arm_smmu_init_queues() allocates<br \/>\nsmmu-&gt;cmdq.q.base. On a devres unwind, whether a failed probe or an<br \/>\nunbind, the queue is freed first and arm_smmu_impl_remove() then runs<br \/>\ntegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC on<br \/>\nthe freed memory.<\/p>\n<p>Observed during testing with a QEMU hack that makes the VCMDQ fail to<br \/>\nenable, so the impl reset fails and probe aborts into the devres unwind:<\/p>\n<p> platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0\/LVCMDQ0: failed to enable, STATUS=0x00000000<br \/>\n platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0\/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0<br \/>\n platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0\/LVCMDQ0: uncleared error detected, resetting<br \/>\n arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl<br \/>\n arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110<br \/>\n Unable to handle kernel paging request at virtual address ffff8000891e0098<br \/>\n &#8230;<br \/>\n Internal error: Oops: 0000000096000047 [#1] SMP<br \/>\n &#8230;<br \/>\n Call trace:<br \/>\n  arm_smmu_cmdq_issue_cmdlist+0x320\/0x6fc (P)<br \/>\n  tegra241_vcmdq_hw_deinit+0x98\/0x168<br \/>\n  tegra241_vintf_hw_deinit+0x5c\/0x1b0<br \/>\n  tegra241_cmdqv_remove_vintf+0x34\/0xec<br \/>\n  tegra241_cmdqv_remove+0x40\/0x9c<br \/>\n  arm_smmu_impl_remove+0x20\/0x30<br \/>\n  devm_action_release+0x14\/0x20<br \/>\n  devres_release_all+0xa8\/0x110<br \/>\n  device_unbind_cleanup+0x18\/0x84<br \/>\n  really_probe+0x1f0\/0x29c<\/p>\n<p>Drop the VINTF deinit from tegra241_cmdqv_remove_vintf() so the unwind no<br \/>\nlonger touches the freed queue. Quiesce the VINTFs earlier instead. Add a<br \/>\ndevice_disable() impl op and run it from arm_smmu_disable_action() while<br \/>\nthe CMDQ is still up. That handles a live unbind. A failed reset is already<br \/>\nhandled because tegra241_vintf_hw_init() deinits the VINTF on its own error<br \/>\npath. tegra241_cmdqv_remove_vintf() is also used by the iommufd viommu<br \/>\ndestroy path, so quiesce there too.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>iommu\/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown<\/p>\n<p>arm_smmu_impl_remove() is registered as a devres action in<br \/>\narm_smmu_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17322","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}