SB20260918246 - Memory leak in Linux kernel arm arm-smmu-v3 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-90424)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to improper resource cleanup in the Tegra241 CMDQV VINTF initialization and removal routines when handling failed VINTF0 initialization or logical VCMDQ preallocation. A local user can trigger these failure paths to cause a memory leak.

VINTF0 can remain unpublished to the VINTF array, preventing probe-failure cleanup from reaching it.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1d2271d7df5230e4ce36bdafd17524bd004f3b3f
• https://git.kernel.org/stable/c/417190bde0fda4ee857999a722ca90163fbec587
• https://git.kernel.org/stable/c/f40f3144477314b489e4bc209c06cb51679fe82b