CVE-2026-80818

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Fix CMD SYNC use-after-free on teardown

arm smmu impl remove() is registered as a devres action in arm smmu impl probe(), before arm smmu init queues() allocates smmu->cmdq.q.base. On a devres unwind, whether a failed probe or an unbind, the queue is freed first and arm smmu impl remove() then runs tegra241 cmdqv remove vintf(), whose VINTF deinit issues a CMD SYNC on the freed memory.

Observed during testing with a QEMU hack that makes the VCMDQ fail to enable, so the impl reset fails and probe aborts into the devres unwind:

platform NVDA200C:00: tegra241 cmdqv: VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000 platform NVDA200C:00: tegra241 cmdqv: VINTF0: VCMDQ0/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0 platform NVDA200C:00: tegra241 cmdqv: VINTF0: VCMDQ0/LVCMDQ0: uncleared error detected, resetting arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110 Unable to handle kernel paging request at virtual address ffff8000891e0098 ... Internal error: Oops: 0000000096000047 [#1] SMP ... Call trace: arm smmu cmdq issue cmdlist+0x320/0x6fc (P) tegra241 vcmdq hw deinit+0x98/0x168 tegra241 vintf hw deinit+0x5c/0x1b0 tegra241 cmdqv remove vintf+0x34/0xec tegra241 cmdqv remove+0x40/0x9c arm smmu impl remove+0x20/0x30 devm action release+0x14/0x20 devres release all+0xa8/0x110 device unbind cleanup+0x18/0x84 really probe+0x1f0/0x29c

Drop the VINTF deinit from tegra241 cmdqv remove vintf() so the unwind no longer touches the freed queue. Quiesce the VINTFs earlier instead. Add a device disable() impl op and run it from arm smmu disable action() while the CMDQ is still up. That handles a live unbind. A failed reset is already handled because tegra241 vintf hw init() deinits the VINTF on its own error path. tegra241 cmdqv remove vintf() is also used by the iommufd viommu destroy path, so quiesce there too.