Out-of-bounds read in Linux kernel - CVE-2026-90425

Vulnerability identifier: #VU151049

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-90425

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in tegra241_vintf_init_vsid() when mapping a guest vSID for a device without stream IDs. A local user can request a guest vSID mapping for such a device to perform an out-of-bounds read.

For devices with multiple stream IDs, only the first stream ID is mapped, preventing guest vSID invalidations from reaching the other ATC and IOTLB entries.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0b139ec4641c7d4163d8e345c26cc630e24fa43b
• https://git.kernel.org/stable/c/9b37afb2d34d99ec4f8db28134181b5a8ec9a4a5
• https://git.kernel.org/stable/c/fb292bfc9be936dade7eef7ec5762de1201983d8

• Out-of-bounds read in Linux kernel arm arm-smmu-v3 driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more