The Linux kernel vulnerability CVE-2026-90429 affects the iommu/tegra241-cmdqv driver where the error ISR (tegra241_cmdqv_isr) accesses the cmdqv->vintfs[] array without proper synchronization against concurrent VINTF teardown (tegra241_cmdqv_deinit_vintf) and initialization (tegra241_cmdqv_init_vintf). This race condition can cause the ISR to dereference a NULL pointer or a freed vintf structure, or to observe partially initialized vintf data due to lack of memory ordering guarantees on weakly-ordered CPUs. The fix involves using smp_store_release() when publishing vintf pointers and smp_load_acquire() when reading them in the ISR, adding NULL checks, and synchronizing IRQs before releasing IDs to prevent use-after-free and stale pointer usage.

The vulnerability allows local attackers with limited privileges to cause kernel crashes (NULL dereference) or potentially execute arbitrary code due to use-after-free conditions. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. Exploitation could lead to system instability or privilege escalation within affected Linux kernel environments using the tegra241-cmdqv driver.

A fix is available that enforces proper synchronization and memory ordering between the error ISR and VINTF initialization and teardown routines. Users should apply the official Linux kernel patches that implement smp_store_release() and smp_load_acquire() memory barriers, add necessary NULL checks, and synchronize IRQs before releasing IDs. Patch status is not explicitly stated in the input but the vulnerability is described as resolved, indicating an official fix exists. Users should consult the Linux kernel vendor advisory or source repository for the relevant patch and update accordingly.