SB20260918247 - Out-of-bounds read in Linux kernel arm arm-smmu-v3 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-90425)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in tegra241_vintf_init_vsid() when mapping a guest vSID for a device without stream IDs. A local user can request a guest vSID mapping for such a device to perform an out-of-bounds read.

For devices with multiple stream IDs, only the first stream ID is mapped, preventing guest vSID invalidations from reaching the other ATC and IOTLB entries.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0b139ec4641c7d4163d8e345c26cc630e24fa43b
• https://git.kernel.org/stable/c/9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5
• https://git.kernel.org/stable/c/fb292bfc9be936dade7eef7ec5762de1201983d8