CVE-2026-90428 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to ensure their systems are updated with the necessary patches.

Why it matters

This vulnerability in the Linux kernel can cause system crashes if not properly patched. Linux kernel developers, maintainers, and users should be aware of this issue and take steps to update their systems with the necessary fixes.

• Potential system crashes due to error interrupts triggered before probe setup.
• Need to verify Linux kernel versions and apply patches to prevent exploitation.
• Importance of monitoring system logs for error interrupts and investigating related issues.

Technical summary

The __tegra241_cmdqv_probe() function requests the error IRQ before allocating and initializing the cmdqv->vintfs array. This can cause the error interrupt to be triggered before the probe sets up the vintfs array, potentially leading to a system crash. To fix this, the error IRQ should be requested only after the cmdqv->vintfs array has been allocated and zeroed. The vulnerability affects Linux kernel versions and can be addressed by applying the necessary patches. Linux kernel developers, maintainers, and users should be aware of this issue and take steps to update their systems with the necessary fixes.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to ensure the error IRQ is requested after the cmdqv->vintfs array has been allocated and zeroed.
• Verify the Linux kernel version and update to a fixed version if necessary.
• Monitor system logs for potential error interrupts and investigate any issues that may be related to this vulnerability.
• Perform a thorough review of system configurations and apply necessary patches.
• Check for any exposed assets and review compensating controls.
• Track exceptions and retest remediated assets.
• Review and update incident response plans to address potential system crashes.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. Linux kernel developers and users should verify Linux kernel versions and apply patches to prevent exploitation. The error interrupt can be triggered before the probe sets up the vintfs array, potentially causing a system crash. To address this, the error IRQ should be requested only after the cmdqv->vintfs array has been allocated and zeroed. Limited source and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.