CVE-2026-80818 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown
arm_smmu_impl_remove() is registered as a devres action in arm_smmu_impl_probe(), before arm_smmu_init_queues() allocates smmu->cmdq.q.base. On a devres unwind, whether a failed probe or an unbind, the queue is freed first and arm_smmu_impl_remove() then runs tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC on the freed memory.
Observed during testing with a QEMU hack that makes the VCMDQ fail to enable, so the impl reset fails and probe aborts into the devres unwind:
platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: uncleared error detected, resetting arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110 Unable to handle kernel paging request at virtual address ffff8000891e0098 ... Internal error: Oops: 0000000096000047 [#1] SMP
... Call trace: arm_smmu_cmdq_issue_cmdlist+0x320/0x6fc (P) tegra241_vcmdq_hw_deinit+0x98/0x168 tegra241_vintf_hw_deinit+0x5c/0x1b0 tegra241_cmdqv_remove_vintf+0x34/0xec tegra241_cmdqv_remove+0x40/0x9c arm_smmu_impl_remove+0x20/0x30 devm_action_release+0x14/0x20 devres_release_all+0xa8/0x110 device_unbind_cleanup+0x18/0x84 really_probe+0x1f0/0x29c
Drop the VINTF deinit from tegra241_cmdqv_remove_vintf() so the unwind no longer touches the freed queue. Quiesce the VINTFs earlier instead. Add a device_disable() impl op and run it from arm_smmu_disable_action() while the CMDQ is still up. That handles a live unbind. A failed reset is already handled because tegra241_vintf_hw_init() deinits the VINTF on its own error path. tegra241_cmdqv_remove_vintf() is also used by the iommufd viommu destroy path, so quiesce there too.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in the Linux kernel involves a use-after-free condition within the Tegra241 IOMMU command queue virtual interface driver. This flaw occurs during the teardown or unbinding phase of the device lifecycle when the system attempts to release resources associated with the ARM SMMU implementation. Specifically, the function arm_smmu_impl_remove is registered as a device resource action in arm_smmu_impl_probe before the actual command queue base memory smmu->cmdq.q.base is allocated via arm_smmu_init_queues. This ordering creates a critical race condition during error handling paths such as failed probes or driver unbinds where the devres unwind mechanism releases resources in reverse order of allocation but without respecting logical dependencies between hardware interface deinitialization and queue availability.
During an unwinding process triggered by a probe failure, the kernel first frees the command queue memory allocated earlier in the initialization sequence. Subsequently, arm_smmu_impl_remove executes tegra241_cmdqv_remove_vintf which attempts to perform virtual interface deinitialization. This operation issues a CMD_SYNC command directly onto the already freed memory region of the command queue. Accessing this deallocated memory results in undefined behavior manifesting as kernel paging requests and internal errors such as Oops exceptions with SMP faults. The observed crash trace confirms that execution flows through arm_smmu_cmdq_issue_cmdlist into hardware deinitialization routines after the underlying data structures have been reclaimed by the device resource management subsystem.
The operational impact of this vulnerability includes system instability, potential kernel panics, and denial of service conditions when devices fail to initialize properly or are dynamically removed from the system. In testing scenarios using QEMU simulations where virtual command queues fail to enable due to hardware status errors like GERROR codes indicating uncleared error states, the driver enters an abort path that triggers the devres cleanup sequence. This leads directly to accessing invalid memory addresses resulting in critical kernel faults that can crash the entire operating environment if not handled gracefully by higher-level recovery mechanisms which may also be compromised during such low-level hardware interaction failures.
To mitigate this issue, the fix involves restructuring the resource management logic within the Tegra241 IOMMU driver to ensure proper sequencing of deinitialization steps relative to memory allocation states. The primary correction removes the VINTF deinit call from tegra241_cmdqv_remove_vintf so that unwinding procedures no longer attempt operations on freed queue structures. Instead, quiescing virtual interfaces is performed earlier in the lifecycle using a new device_disable implementation operation executed within arm_smmu_disable_action while the command queue remains active and valid. This ensures hardware state consistency before any memory release occurs. Additionally, similar quiescence logic is applied to the iommufd viommu destroy path maintaining uniform safety across different interface usage models including live unbind scenarios where dynamic removal must not compromise kernel integrity through invalid memory accesses.
This vulnerability aligns with CWE-416 Use After Free which describes situations where software continues to use a pointer after it has been freed leading to unpredictable behavior and potential security breaches. From an ATT&CK perspective, while this specific instance represents a stability flaw rather than an exploitable attack vector for privilege escalation or remote code execution in typical deployments, improper memory handling patterns like these can sometimes be leveraged by attackers who induce probe failures through crafted device configurations or hardware emulation techniques to trigger kernel crashes as part of denial-of-service attacks against virtualized environments relying on accurate IOMMU simulation. Proper resource ordering and state validation during driver teardown remain essential practices for maintaining robustness in complex subsystems involving direct hardware interaction and dynamic memory management within the Linux kernel architecture.