CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Reject a vSID wider than the SID MATCH field

tegra241 vintf init vsid() programs the guest-provided vSID into SID MATCH, whose VIRT SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID.

The bound check rejects only virt sid > UINT MAX, which admits a value far wider than the field. The write "virt sid << 1 | 0x1" then drops every bit above 20: a virt sid of 0x80000000 lands as SID MATCH = 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt id is guest-controlled, a VMM can trigger it.

Validate virt sid against the field width with FIELD MAX(), and program the register with FIELD PREP() so the value and the field stay consistent.