CVE-2026-90425

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the tegra241 vintf init vsid() function where a guest vSID is mapped to a single physical Stream ID from master->streams[0]. If a device has multiple streams, only the first is mapped, preventing guest vSID invalidation from reaching other ATC (Address Translation Cache) and IOTLB (Input/Output Translation Lookaside Buffer) entries. If a device has no streams, master->streams becomes a ZERO SIZE PTR, leading to an out-of-bounds read.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.