CVE-2026-89450

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-89450

Key Details

CVE	CVE-2026-89450
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field

tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,

whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.

The HW therefore matches only a 20-bit Stream ID.

The bound check rejects only virt_sid > UINT_MAX, which admits a value far

wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit

above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match

on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id

is guest-controlled, a VMM can trigger it.

Validate virt_sid against the field width with FIELD_MAX(), and program the

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89450
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89450

Source

Reference

NVD

CVE