CVE-2026-90426

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the tegra241 cmdqv remove() function where VINTFs are torn down before the error IRQ is freed. This sequence creates a window where the tegra241 cmdqv isr() function can read a stale slot and pass it to tegra241 vintf0 handle error(), leading to a NULL or freed pointer dereference. This occurs because tearing down a VINTF frees vintf0 and clears cmdqv->vintfs[0] while the interrupt service routine (ISR) may still be active.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.