GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89450 (GCVE-0-2026-89450)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-13 06:29
VLAI
Title
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, which admits a value far wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it. Validate virt_sid against the field width with FIELD_MAX(), and program the register with FIELD_PREP() so the value and the field stay consistent.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 , < d903d99ffd22b0180bd745a43f221c21bcdd8d7c (git)
Affected: 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 , < 445204550f894ca325ac80a21e3df177ad073798 (git)
Affected: 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 , < 4379610c79bd88ddbea10e7f6c21e16d4b338c6b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d903d99ffd22b0180bd745a43f221c21bcdd8d7c",
              "status": "affected",
              "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
              "versionType": "git"
            },
            {
              "lessThan": "445204550f894ca325ac80a21e3df177ad073798",
              "status": "affected",
              "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
              "versionType": "git"
            },
            {
              "lessThan": "4379610c79bd88ddbea10e7f6c21e16d4b338c6b",
              "status": "affected",
              "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\nThe HW therefore matches only a 20-bit Stream ID.\n\nThe bound check rejects only virt_sid \u003e UINT_MAX, which admits a value far\nwider than the field. The write \"virt_sid \u003c\u003c 1 | 0x1\" then drops every bit\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev-\u003evirt_id\nis guest-controlled, a VMM can trigger it.\n\nValidate virt_sid against the field width with FIELD_MAX(), and program the\nregister with FIELD_PREP() so the value and the field stay consistent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only via local ioctl on /dev/iommu or VFIO-compat /dev/vfio/vfio: iommufd_fops_ioctl() dispatches IOMMU_VDEVICE_ALLOC to iommufd_vdevice_alloc_ioctl(), which calls tegra241_vintf_init_vsid() to program SID_MATCH. There is no network or packet path into CMDQV SID programming.\nAC:L - The attacker fully chooses cmd-\u003evirt_id; the old UINT_MAX check accepts values such as 0x80000000, and writel(virt_sid\u003c\u003c1|0x1) deterministically truncates them onto a 20-bit SID_MATCH (aliasing vSID 0). No race or uninfluenced memory layout is required on NVIDIA Grace/CMDQV.\nPR:L - iommufd_fops_open() and the ioctl table have no capable() gate (/dev/iommu 0660, /dev/vfio/vfio 0666). A tenant or unprivileged QEMU user granted VFIO/iommufd access on Grace can bind a CMDQV-backed device, alloc a TEGRA241_CMDQV vIOMMU, and issue VDEVICE_ALLOC without init-namespace root.\nUI:N - The attacker performs the full sequence themselves (open iommufd, bind the assigned device, alloc vIOMMU/vDEVICE with a truncated virt_id, then guest ATC_INV via VCMDQ). No separate victim action such as mounting a filesystem is required.\nS:C - Truncating a guest-controlled vSID into SID_MATCH aliases it onto another Stream ID so CMDQV rewrites ATC_INV/CFGI to the wrong pSID. That is an IOMMU/DMA boundary bypass: missed invalidations leave stale ATS/IOTLB entries and let device DMA reach host memory outside the guest domain.\nC:H - Wrong SID_MATCH/SID_REPLACE pairing leaves stale ATS translations after IOVA unmap, so a guest-controlled passthrough device can DMA-read host pages recycled by the allocator, yielding an arbitrary host-memory disclosure primitive through the IOMMU.\nI:H - The same stale or retargeted translations allow DMA writes into unmapped host pages, and aliased CFGI/ATC_INV operate on the wrong physical Stream ID, corrupting IOMMU translation state and providing an arbitrary write suitable for control-flow hijack.\nA:H - Misdirected invalidation and CFGI cause SMMU translation faults, DMA into recycled kernel pages, and CMDQV GERROR/ISR failures that oops or panic the host; the truncated vSID can be programmed repeatedly on every VDEVICE_ALLOC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:29:30.075Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798"
        },
        {
          "url": "https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b"
        }
      ],
      "title": "iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89450",
    "datePublished": "2026-09-11T19:43:16.060Z",
    "dateReserved": "2026-09-11T19:38:34.706Z",
    "dateUpdated": "2026-09-13T06:29:30.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89450",
      "date": "2026-09-16",
      "epss": "0.00127",
      "percentile": "0.02717"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89450\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:25.603\",\"lastModified\":\"2026-09-13T07:17:09.350\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\\n\\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\\nThe HW therefore matches only a 20-bit Stream ID.\\n\\nThe bound check rejects only virt_sid \u003e UINT_MAX, which admits a value far\\nwider than the field. The write \\\"virt_sid \u003c\u003c 1 | 0x1\\\" then drops every bit\\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev-\u003evirt_id\\nis guest-controlled, a VMM can trigger it.\\n\\nValidate virt_sid against the field width with FIELD_MAX(), and program the\\nregister with FIELD_PREP() so the value and the field stay consistent.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7\",\"lessThan\":\"d903d99ffd22b0180bd745a43f221c21bcdd8d7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7\",\"lessThan\":\"445204550f894ca325ac80a21e3df177ad073798\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7\",\"lessThan\":\"4379610c79bd88ddbea10e7f6c21e16d4b338c6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-14T19:14:05+00:00",
      "cve": "CVE-2026-89450",
      "id": "CVE-2026-89450",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89450.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:03:41Z",
      "cve": "CVE-2026-89450",
      "id": "CVE-2026-89450",
      "initial_release_date": "2026-09-12T16:28:15Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89450",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89450.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.