CVE-2026-89450

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89450", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.706Z", "datePublished": "2026-09-11T19:43:16.060Z", "dateUpdated": "2026-10-19T08:46:59.901Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:46:59.901Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\nThe HW therefore matches only a 20-bit Stream ID.\n\nThe bound check rejects only virt_sid > UINT_MAX, which admits a value far\nwider than the field. The write \"virt_sid << 1 | 0x1\" then drops every bit\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id\nis guest-controlled, a VMM can trigger it.\n\nValidate virt_sid against the field width with FIELD_MAX(), and program the\nregister with FIELD_PREP() so the value and the field stay consistent."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reached only via local ioctl on /dev/iommu or VFIO-compat /dev/vfio/vfio: iommufd_fops_ioctl() dispatches IOMMU_VDEVICE_ALLOC to iommufd_vdevice_alloc_ioctl(), which calls tegra241_vintf_init_vsid() to program SID_MATCH. There is no network or packet path into CMDQV SID programming.\nAC:L - The attacker fully chooses cmd->virt_id; the old UINT_MAX check accepts values such as 0x80000000, and writel(virt_sid<<1|0x1) deterministically truncates them onto a 20-bit SID_MATCH (aliasing vSID 0). No race or uninfluenced memory layout is required on NVIDIA Grace/CMDQV.\nPR:L - iommufd_fops_open() and the ioctl table have no capable() gate (/dev/iommu 0660, /dev/vfio/vfio 0666). A tenant or unprivileged QEMU user granted VFIO/iommufd access on Grace can bind a CMDQV-backed device, alloc a TEGRA241_CMDQV vIOMMU, and issue VDEVICE_ALLOC without init-namespace root.\nUI:N - The attacker performs the full sequence themselves (open iommufd, bind the assigned device, alloc vIOMMU/vDEVICE with a truncated virt_id, then guest ATC_INV via VCMDQ). No separate victim action such as mounting a filesystem is required.\nS:C - Truncating a guest-controlled vSID into SID_MATCH aliases it onto another Stream ID so CMDQV rewrites ATC_INV/CFGI to the wrong pSID. That is an IOMMU/DMA boundary bypass: missed invalidations leave stale ATS/IOTLB entries and let device DMA reach host memory outside the guest domain.\nC:H - Wrong SID_MATCH/SID_REPLACE pairing leaves stale ATS translations after IOVA unmap, so a guest-controlled passthrough device can DMA-read host pages recycled by the allocator, yielding an arbitrary host-memory disclosure primitive through the IOMMU.\nI:H - The same stale or retargeted translations allow DMA writes into unmapped host pages, and aliased CFGI/ATC_INV operate on the wrong physical Stream ID, corrupting IOMMU translation state and providing an arbitrary write suitable for control-flow hijack.\nA:H - Misdirected invalidation and CFGI cause SMMU translation faults, DMA into recycled kernel pages, and CMDQV GERROR/ISR failures that oops or panic the host; the truncated vSID can be programmed repeatedly on every VDEVICE_ALLOC."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "versions": [{"version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "lessThan": "d903d99ffd22b0180bd745a43f221c21bcdd8d7c", "status": "affected", "versionType": "git"}, {"version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "lessThan": "445204550f894ca325ac80a21e3df177ad073798", "status": "affected", "versionType": "git"}, {"version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "lessThan": "4379610c79bd88ddbea10e7f6c21e16d4b338c6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"}, {"url": "https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798"}, {"url": "https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b"}], "title": "iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d903d99ffd22b0180bd745a43f221c21bcdd8d7c", "status": "affected", "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "versionType": "git"}, {"lessThan": "445204550f894ca325ac80a21e3df177ad073798", "status": "affected", "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "versionType": "git"}, {"lessThan": "4379610c79bd88ddbea10e7f6c21e16d4b338c6b", "status": "affected", "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\nThe HW therefore matches only a 20-bit Stream ID.\n\nThe bound check rejects only virt_sid > UINT_MAX, which admits a value far\nwider than the field. The write \"virt_sid << 1 | 0x1\" then drops every bit\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id\nis guest-controlled, a VMM can trigger it.\n\nValidate virt_sid against the field width with FIELD_MAX(), and program the\nregister with FIELD_PREP() so the value and the field stay consistent."}], "id": "CVE-2026-89450", "lastModified": "2026-10-19T09:17:37.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:25.603", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: IOMMU vulnerability allows a VMM to alias wrong Stream ID via oversized vSID", "id": "2532062", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532062"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-681", "details": ["A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager (VMM) can exploit this vulnerability by providing a virtual Stream ID (vSID) that exceeds the intended 20-bit width of the SID_MATCH field. This improper input validation causes the system to incorrectly process the vSID, leading to the aliasing of an unintended Stream ID. This could result in unexpected behavior or security bypasses within the IOMMU."], "name": "CVE-2026-89450", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:43:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89450\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89450\nhttps://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b\nhttps://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798\nhttps://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7,d903d99ffd22b0180bd745a43f221c21bcdd8d7c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7,445204550f894ca325ac80a21e3df177ad073798)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7,4379610c79bd88ddbea10e7f6c21e16d4b338c6b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T06:15:03.871076+00:00", "updated": "2026-09-21T01:30:08.760570+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}