{ "cveId": "CVE-2026-90424", "url": "https://patchblox.com/security/cve/CVE-2026-90424", "summary": "CVE-2026-90424 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-90424, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the ini...", "description": "In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the cmdqv-\u003Evintfs[] array, so the devres unwind on probe failure cannot reach it; free it directly there. A later VCMDQ preallocation failure instead leaves VINTF0 published, and so this time the unwind does reach tegra241_cmdqv_remove_vintf(), which then frees it from vintf-\u003Ehyp_own. But tegra241_vintf_hw_init() sets that flag only afterward, from a HW read-back, so the still-uninited VINTF0 reads as guest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields it never set up. Decide ownership from vintf-\u003Eidx instead, the index assigned when its id is allocated: idx 0 is the kernel-owned VINTF0, while idx \u003E= 1 marks a guest VINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and tegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure HW-readback state.", "published": "2026-09-17T17:17:47Z", "severity": "important", "epss": 0.00168, "epssPercentile": 0.0618, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.54-121.166", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.115-2", "fix": "DEBIAN-CVE-2026-90424", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90424", "released": "2026-09-23T19:19:02Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.6-1", "fix": "DEBIAN-CVE-2026-90424", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90424", "released": "2026-09-23T19:19:02Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.54-121.166.amzn2023", "fix": "ALAS2023-2026-3192", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3192", "released": "2026-11-07T01:06:07Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }