{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89450", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.706Z", "datePublished": "2026-09-11T19:43:16.060Z", "dateUpdated": "2026-09-11T19:43:16.060Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:43:16.060Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\nThe HW therefore matches only a 20-bit Stream ID.\n\nThe bound check rejects only virt_sid > UINT_MAX, which admits a value far\nwider than the field. The write \"virt_sid << 1 | 0x1\" then drops every bit\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id\nis guest-controlled, a VMM can trigger it.\n\nValidate virt_sid against the field width with FIELD_MAX(), and program the\nregister with FIELD_PREP() so the value and the field stay consistent."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "versions": [{"version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "lessThan": "d903d99ffd22b0180bd745a43f221c21bcdd8d7c", "status": "affected", "versionType": "git"}, {"version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "lessThan": "445204550f894ca325ac80a21e3df177ad073798", "status": "affected", "versionType": "git"}, {"version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "lessThan": "4379610c79bd88ddbea10e7f6c21e16d4b338c6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"}, {"url": "https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798"}, {"url": "https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b"}], "title": "iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d903d99ffd22b0180bd745a43f221c21bcdd8d7c", "status": "affected", "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "versionType": "git"}, {"lessThan": "445204550f894ca325ac80a21e3df177ad073798", "status": "affected", "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "versionType": "git"}, {"lessThan": "4379610c79bd88ddbea10e7f6c21e16d4b338c6b", "status": "affected", "version": "4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\nThe HW therefore matches only a 20-bit Stream ID.\n\nThe bound check rejects only virt_sid > UINT_MAX, which admits a value far\nwider than the field. The write \"virt_sid << 1 | 0x1\" then drops every bit\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id\nis guest-controlled, a VMM can trigger it.\n\nValidate virt_sid against the field width with FIELD_MAX(), and program the\nregister with FIELD_PREP() so the value and the field stay consistent."}], "id": "CVE-2026-89450", "lastModified": "2026-09-11T20:19:25.603", "metrics": {}, "published": "2026-09-11T20:19:25.603", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: IOMMU vulnerability allows a VMM to alias wrong Stream ID via oversized vSID", "id": "2532062", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532062"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-681", "details": ["A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager (VMM) can exploit this vulnerability by providing a virtual Stream ID (vSID) that exceeds the intended 20-bit width of the SID_MATCH field. This improper input validation causes the system to incorrectly process the vSID, leading to the aliasing of an unintended Stream ID. This could result in unexpected behavior or security bypasses within the IOMMU."], "name": "CVE-2026-89450", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-11T19:43:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89450\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89450\nhttps://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b\nhttps://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798\nhttps://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"], "threat_severity": "Important"}

{}