CVE-2026-90427

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the tegra241 cmdqv probe() function where devm krealloc() is used to expand the smmu variable into a larger tegra241 cmdqv structure. This process frees the original smmu memory upon relocation. If a failure occurs after this operation, the function returns NULL, leading the caller to dereference the freed smmu pointer during its fallback path, resulting in a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.