{"id":"CVE-2026-89450","title":"iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spa…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-681"],"vendor":"Linux","product":"Linux","affected":["Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < d903d99ffd22b0180bd745a43f221c21bcdd8d7c","Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < 445204550f894ca325ac80a21e3df177ad073798","Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < 4379610c79bd88ddbea10e7f6c21e16d4b338c6b","Linux 6.17"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:59.901Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89450","references":[{"url":"https://git.kernel.org/stable/c/d903d99ffd22b0180bd745a43f221c21bcdd8d7c"},{"url":"https://git.kernel.org/stable/c/445204550f894ca325ac80a21e3df177ad073798"},{"url":"https://git.kernel.org/stable/c/4379610c79bd88ddbea10e7f6c21e16d4b338c6b"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89450.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89450"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532062"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89450"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89450"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89450.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00127,"epssPercentile":0.02377,"scores":{"cna":8.8,"vendor":7.8},"ingestedAt":"2026-09-14T15:23:07.475Z","slug":"CVE-2026-89450","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field\n\ntegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,\nwhose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.\nThe HW therefore matches only a 20-bit Stream ID.\n\nThe bound check rejects only virt_sid > UINT_MAX, which admits a value far\nwider than the field. The write \"virt_sid << 1 | 0x1\" then drops every bit\nabove 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match\non vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id\nis guest-controlled, a VMM can trigger it.\n\nValidate virt_sid against the field width with FIELD_MAX(), and program the\nregister with FIELD_PREP() so the value and the field stay consistent.\n\n## Affected\n\n- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < d903d99ffd22b0180bd745a43f221c21bcdd8d7c`\n- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < 445204550f894ca325ac80a21e3df177ad073798`\n- `Linux >= 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 < 4379610c79bd88ddbea10e7f6c21e16d4b338c6b`\n- `Linux 6.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-27 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89450.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224759,"id":"CVE-2026-89450","ts":1792401527713,"field":"cvss","old":"7.8","new":"8.8"},{"seq":211832,"id":"CVE-2026-89450","ts":1790581657424,"field":"cvss","old":"7","new":"7.8"},{"seq":203031,"id":"CVE-2026-89450","ts":1789403733426,"field":"cvss","old":"8.8","new":"7"},{"seq":198060,"id":"CVE-2026-89450","ts":1789384321609,"field":"cvss","old":"7","new":"8.8"},{"seq":183795,"id":"CVE-2026-89450","ts":1789356677425,"field":"cvss","old":"8.8","new":"7"},{"seq":153232,"id":"CVE-2026-89450","ts":1789285349653,"field":"cvss","old":null,"new":"8.8"},{"seq":153231,"id":"CVE-2026-89450","ts":1789285349653,"field":"severity","old":"none","new":"high"},{"seq":109602,"id":"CVE-2026-89450","ts":1789183732580,"field":"cvss","old":null,"new":"7"},{"seq":109601,"id":"CVE-2026-89450","ts":1789183732580,"field":"severity","old":"none","new":"high"}]}