Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 before b1605a56745f22670205f6561df5771bbbb62a99; affected 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 before 2f627118b668659c6b195ac48beedb1bf8f53368; affected 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 before a168254ff8db08f2292be3d8fcbd37d2bb8c3d2d; affected 918eb5c856f6ce4cf93b4b38e4b5e156905c5943 before 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd |
| Linux / Linux | affected 6.12; unaffected 0 before 6.12; unaffected 6.12.110 through 6.12.*; unaffected 6.18.52 through 6.18.*; unaffected 7.2.6 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.