{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90430 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90430 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90430 and fix it if it is affected.\n\nWhat it is: CVE-2026-90430 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90430 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90430/ (Markdown: https://insights.sbomify.com/CVE-2026-90430/index.md)","id":"CVE-2026-90430","markdown":"https://insights.sbomify.com/CVE-2026-90430/index.md","name":"CVE-2026-90430","record":{"aliases":["BELL-CVE-2026-90430","DEBIAN-CVE-2026-90430","GHSA-fq43-87xx-qq28","UBUNTU-CVE-2026-90430"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A race condition in the Tegra241 IOMMU driver allows a local attacker to trigger a kernel crash via null pointer dereference during device initialization.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized\n\ntegra241_vintf_init_lvcmdq() stores the freshly allocated vcmdq pointer to\nthe vintf-\u003elvcmdqs[] array, before tegra241_vcmdq_alloc_smmu_cmdq() builds\nthe vcmdq-\u003ecmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ\nerror (e.g. one inherited across a kexec) firing in this window would make\ntegra241_vintf0_handle_error() pass the still-zeroed arm_smmu_cmdq down to\n__arm_smmu_cmdq_skip_err(), dereferencing NULL queue register pointers.\n\nDrop the store from tegra241_vintf_init_lvcmdq() and publish the vcmdq at\nthe end of the allocation instead, with an smp_store_release() that pairs\nwith an smp_load_acquire() in the ISR, which can see a fully built LVCMDQ\nor NULL.\n\nThe user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq\nonce tegra241_vcmdq_hw_init_user() succeeds, using a plain store since a\nuser VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks\nthe VINTF0 array.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized","id":"CVE-2026-90430","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"remoteproc: Prevent crash handling to race with rproc_del()","id":"CVE-2026-90431"},"packages":[],"prev":{"headline":"iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init","id":"CVE-2026-90429"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Tegra241 IOMMU driver allows a local attacker to trigger a kernel crash via null pointer dereference during device initialization.","url":"https://insights.sbomify.com/CVE-2026-90430/"}