In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent()
Two WARNINGs are observed when SMMU driver rolls back upon failure: arm-smmu-v3.9.auto: Failed to register iommu arm-smmu-v3.9.auto: probe with driver arm-smmu-v3 failed with error -22 ------------[ cut here ]------------ WARNING: CPU: 5 PID: 1 at kernel/dma/mapping.c:74 dmam_free_coherent+0xc0/0xd8 Call trace: dmam_free_coherent+0xc0/0xd8 (P) tegra241_vintf_free_lvcmdq+0x74/0x188 tegra241_cmdqv_remove_vintf+0x60/0x148 tegra241_cmdqv_remove+0x48/0xc8 arm_smmu_impl_remove+0x28/0x60 devm_action_release+0x1c/0x40 ------------[ cut here ]------------ 128 pages are still in use! WARNING: CPU: 16 PID: 1 at mm/page_alloc.c:6902 free_contig_range+0x18c/0x1c8 Call trace: free_contig_range+0x18c/0x1c8 (P) cma_release+0x154/0x2f0 dma_free_contiguous+0x38/0xa0 dma_direct_free+0x10c/0x248 dma_free_attrs+0x100/0x290 dmam_free_coherent+0x78/0xd8 tegra241_vintf_free_lvcmdq+0x74/0x160 tegra241_cmdqv_remove+0x98/0x198 arm_smmu_impl_remove+0x28/0x60 devm_action_release+0x1c/0x40
This is because the LVCMDQ queue memory are managed by devres, while that dmam_free_coherent() is called in the context of devm_action_release().
Jason pointed out that "arm_smmu_impl_probe() has mis-ordered the devres callbacks if ops->device_remove() is going to be manually freeing things that probe allocated": https://lore.kernel.org/linux-iommu/[email protected]/
In fact, tegra241_cmdqv_init_structures() only allocates memory resources which means any failure that it generates would be similar to -ENOMEM, so there is no point in having that "falling back to standard SMMU" routine, as the standard SMMU would likely fail to allocate memory too.
Remove the unwind part in tegra241_cmdqv_init_structures(), and return a proper error code to ask SMMU driver to call tegra241_cmdqv_remove() via impl_ops->device_remove(). Then, drop tegra241_vintf_free_lvcmdq() since devres will take care of that.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf6.12Upgrade kernel-libbpf-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel6.12Upgrade kernel-tools-develUpgrade kernel-develUpgrade perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel-libbpfUpgrade python3-perf6.12Upgrade kernel-livepatch-6.12.25-32.101 | Aug 5, 2025 | May 9, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 9, 2025 |
| Suse | — | Upgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-azure-vdsoUpgrade kernel-docsUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade kernel-source-vanillaUpgrade kernel-azure-extraUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-develUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-default-vdsoUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-docs-html | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-gcpUpgrade linux-image-raspiUpgrade linux-image-genericUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-azureUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-awsUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-aws-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-22-generic | Jun 26, 2025 | May 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub