EUVD-2026-76356
GHSA-4jcm-3g5m-55hr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local access with guest-level (PR:L) privilege; scope change to host IOMMU domain from guest-controlled virt_id yields full C:H/I:H/A:H across the isolation boundary.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID.
The bound check rejects only virt_sid > UINT_MAX, which admits a value far wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it.
Validate virt_sid against the field width with FIELD_MAX(), and program the register with FIELD_PREP() so the value and the field stay consistent.
AnalysisAI
IOMMU Stream ID aliasing in the Linux kernel's Tegra241 CMDQV driver allows a guest-controlled VMM to break IOMMU isolation by supplying an oversized virtual Stream ID. The bounds check in tegra241_vintf_init_vsid() only rejects values exceeding UINT_MAX, but the SID_MATCH register's VIRT_SID field is only 20 bits wide; the 'virt_sid << 1 | 0x1' encoding silently truncates bits above position 20, causing a value like 0x80000000 to alias SID_MATCH to vSID 0 and route the IOMMU entry to the wrong DMA Stream ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target machine to be running on NVIDIA Tegra241 (Grace) hardware with the tegra241-cmdqv IOMMU driver loaded and at least one virtual IOMMU interface (vINTF) configured for guest use with CMDQV virtualization enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H score of 8.8 is well-calibrated: the scope change (S:C) is the critical differentiator, reflecting a guest-to-host IOMMU isolation bypass that elevates a PR:L local flaw into a full host compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available in the Linux stable kernel repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify any Linux systems using Tegra241 hardware or virtualization hosts supporting Tegra241 guests, and flag as requiring urgent patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today