---
id: CVE-2026-80818
title: 'iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

  arm_smmu_impl_remove() is registered as a devres action in
  arm_smmu_impl_probe(), before arm_smmu_init_qu…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 <
    d2ab08437e913d9e4dda4dfd0d327446ec8717fc
  - >-
    Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 <
    a94309bb99eaf0c6a2ace4927864486d19458eb5
  - >-
    Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 <
    5994617e09ee6016c1b094f29d9c85cac944b477
  - >-
    Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 <
    9ff145a25c5c8a26b06ef7cf558fb536b18bba6d
  - Linux 6.17
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:11.934Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80818'
references:
  - url: 'https://git.kernel.org/stable/c/d2ab08437e913d9e4dda4dfd0d327446ec8717fc'
  - url: 'https://git.kernel.org/stable/c/a94309bb99eaf0c6a2ace4927864486d19458eb5'
  - url: 'https://git.kernel.org/stable/c/5994617e09ee6016c1b094f29d9c85cac944b477'
  - url: 'https://git.kernel.org/stable/c/9ff145a25c5c8a26b06ef7cf558fb536b18bba6d'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.10314
ingestedAt: '2026-10-19T09:16:01.505Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

arm_smmu_impl_remove() is registered as a devres action in
arm_smmu_impl_probe(), before arm_smmu_init_queues() allocates
smmu->cmdq.q.base. On a devres unwind, whether a failed probe or an
unbind, the queue is freed first and arm_smmu_impl_remove() then runs
tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC on
the freed memory.

Observed during testing with a QEMU hack that makes the VCMDQ fail to
enable, so the impl reset fails and probe aborts into the devres unwind:

 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000
 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0
 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: uncleared error detected, resetting
 arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl
 arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110
 Unable to handle kernel paging request at virtual address ffff8000891e0098
 ...
 Internal error: Oops: 0000000096000047 [#1] SMP
 ...
 Call trace:
  arm_smmu_cmdq_issue_cmdlist+0x320/0x6fc (P)
  tegra241_vcmdq_hw_deinit+0x98/0x168
  tegra241_vintf_hw_deinit+0x5c/0x1b0
  tegra241_cmdqv_remove_vintf+0x34/0xec
  tegra241_cmdqv_remove+0x40/0x9c
  arm_smmu_impl_remove+0x20/0x30
  devm_action_release+0x14/0x20
  devres_release_all+0xa8/0x110
  device_unbind_cleanup+0x18/0x84
  really_probe+0x1f0/0x29c

Drop the VINTF deinit from tegra241_cmdqv_remove_vintf() so the unwind no
longer touches the freed queue. Quiesce the VINTFs earlier instead. Add a
device_disable() impl op and run it from arm_smmu_disable_action() while
the CMDQ is still up. That handles a live unbind. A failed reset is already
handled because tegra241_vintf_hw_init() deinits the VINTF on its own error
path. tegra241_cmdqv_remove_vintf() is also used by the iommufd viommu
destroy path, so quiesce there too.

## Affected

- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < d2ab08437e913d9e4dda4dfd0d327446ec8717fc`
- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < a94309bb99eaf0c6a2ace4927864486d19458eb5`
- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < 5994617e09ee6016c1b094f29d9c85cac944b477`
- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < 9ff145a25c5c8a26b06ef7cf558fb536b18bba6d`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.