CVE-2026-89450 Overview
CVE-2026-89450 is an improper input validation flaw in the Linux kernel's iommu/tegra241-cmdqv driver. The tegra241_vintf_init_vsid() function programs a guest-provided virtual Stream ID (vSID) into the SID_MATCH register without validating against the hardware field width. The bounds check only rejects values greater than UINT_MAX, while the VIRT_SID field spans only bits [20:1]. A guest-controlled virt_id can silently truncate, causing an entry to alias the wrong Stream ID. A virtual machine monitor (VMM) can trigger this condition and break IOMMU isolation between guests.
Critical Impact
A local low-privileged actor with VMM access can alias virtual Stream IDs, breaking IOMMU isolation and enabling cross-guest data compromise on Tegra241 CMDQV platforms.
Affected Products
- Linux kernel builds containing the iommu/tegra241-cmdqv driver prior to the fix commits
- NVIDIA Tegra241 SMMU CMDQV virtualization deployments
- Stable kernel branches referenced in the upstream commits 4379610c79bd, 445204550f89, and d903d99ffd22
Discovery Timeline
- 2026-09-11 - CVE-2026-89450 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89450
Vulnerability Analysis
The vulnerability resides in tegra241_vintf_init_vsid(), which writes a guest-supplied virt_sid into the SID_MATCH register. The register's VIRT_SID field occupies bits [20:1], with bit 0 acting as the match-enable flag. The hardware therefore only matches a 20-bit Stream ID.
The existing bound check only rejects virt_sid > UINT_MAX, allowing values far wider than the field can hold. The write expression virt_sid << 1 | 0x1 silently discards every bit above position 20. As a result, a virt_sid of 0x80000000 collapses to SID_MATCH = 0x1, aliasing vSID 0.
Because vdev->virt_id originates from the guest through the VMM, an attacker controlling those values can force one guest's DMA traffic to match another guest's Stream ID entry. This breaks the isolation guarantee the IOMMU is meant to provide.
Root Cause
The root cause is improper input validation combined with numeric truncation. The driver validates the input against a wider integer type (UINT_MAX) than the destination hardware field. When the truncated bits vanish silently, distinct guest inputs collapse to the same effective Stream ID.
Attack Vector
Exploitation requires local access with the privilege to configure a guest through a VMM on a host using the Tegra241 CMDQV IOMMU driver. The attacker supplies a crafted virt_id exceeding the 20-bit field width. The truncated write installs an aliased SID_MATCH entry, allowing DMA operations from the malicious guest to target another guest's Stream ID space.
No user interaction is required. The scope is changed because the vulnerable component (the host IOMMU driver) affects resources outside its security boundary — specifically, the isolation of other virtual machines.
Detection Methods for CVE-2026-89450
Indicators of Compromise
- Unexpected DMA transactions in SMMU fault logs referencing Stream IDs that do not correspond to any legitimately provisioned guest device
- VMM logs showing guest device passthrough configurations with virt_id values greater than 0xFFFFF (20 bits)
- Kernel messages from arm-smmu-v3 or tegra241-cmdqv indicating mismatched or duplicated SID_MATCH entries
Detection Strategies
- Audit running kernel versions on Tegra241 hosts and compare against the fixed commit hashes 4379610c79bd, 445204550f89, and d903d99ffd22
- Monitor hypervisor configuration APIs for guest-supplied virtual Stream IDs outside the valid 20-bit range
- Enable IOMMU event tracing to correlate DMA fault events with guest device assignment operations
Monitoring Recommendations
- Ship SMMU and IOMMU kernel telemetry to a centralized log platform for cross-host correlation
- Alert on any VMM operation that fails input validation for device passthrough parameters
- Track kernel package versions across virtualization hosts to identify unpatched Tegra241 systems
How to Mitigate CVE-2026-89450
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 4379610c79bd88ddbea10e7f6c21e16d4b338c6b, 445204550f894ca325ac80a21e3df177ad073798, and d903d99ffd22b0180bd745a43f221c21bcdd8d7c
- Restrict VMM administrative access to trusted operators until patches are deployed
- Inventory all Tegra241-based virtualization hosts and prioritize their remediation
Patch Information
The upstream fix validates virt_sid against the field width using FIELD_MAX() and programs the register with FIELD_PREP(), keeping the value and the field width consistent. The patch is available across stable kernel branches through the three commits published on git.kernel.org. See the Kernel Git Commit Update 1, Kernel Git Commit Update 2, and Kernel Git Commit Update 3 for exact diffs.
Workarounds
- Disable device passthrough for guests on affected Tegra241 CMDQV hosts until the kernel is patched
- Enforce VMM-side validation to reject any guest-supplied virtual Stream ID greater than 0xFFFFF
- Reduce the attack surface by limiting which local accounts can invoke guest configuration interfaces
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
