CVE-2026-90425 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems and configurations should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the Linux kernel version and review system configurations and Stream ID mappings to ensure correct functionality and prevent potential issues with guest vSID invalidation and ATC and IOTLB entries.

Why it matters

Defenders should prioritize verifying the Linux kernel version and applying patches to address this vulnerability, as it can lead to issues with guest vSID invalidation and ATC and IOTLB entries.

• Verify Linux kernel version and apply patches to prevent potential issues with guest vSID invalidation
• Review system configurations and Stream ID mappings to ensure correct functionality

Technical summary

The tegra241_vintf_init_vsid() function in the Linux kernel's iommu/tegra241-cmdqv module maps a guest vSID to a single physical Stream ID. However, it only warns when a device does not have exactly one stream, which can lead to issues with guest vSID invalidation and ATC and IOTLB entries. To address this, the mapping is now rejected with -EOPNOTSUPP if the device has a different number of streams.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and applying patches to address this vulnerability.

Recommended defensive actions

• Verify Linux kernel version and apply patches
• Review system configurations and Stream ID mappings
• Monitor for potential issues with guest vSID invalidation
• Perform compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Review vendor-supported updates or mitigations

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. However, the scope of affected systems and versions is not explicitly stated. Defenders should verify the Linux kernel version and review system configurations and Stream ID mappings to ensure correct functionality. Evidence is limited to publicly available information and may not be comprehensive. Further verification tasks are necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.