The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the     error ISR against VINTF (de)init A user VINTF is torn down by tegra241_cmdqv_deinit_vintf(), which runs     from the destroy callback and from the init-failure unwind in the alloc handler. It clears the     cmdqv->vintfs[] slot and lets the iommufd core free it, but nothing serializes that against the error     interrupt: tegra241_cmdqv_isr() reads cmdqv->vintfs[idx] and dereferences the vintf. A concurrent error     can make the ISR read a slot mid-clear (a NULL deref) or use a vintf which is about to be freed (a use-     after-free). deinit_vintf() also returns idx to the IDA before clearing the slot, so a concurrent create     that reuses idx can publish its new vintf into the slot, only for this teardown to erase it again with the     stale NULL store. On the other end, tegra241_cmdqv_init_vintf() publishes a new vintf with a plain store     to the cmdqv->vintfs[] slot, and the ISR dereferences fields of a published vintf such as vintf->base. A     plain store gives no ordering on a weakly-ordered CPU, and a stale VINTF_ERR_MAP bit on a reused idx can     make the ISR pick a vintf the moment it is published, before its fields are set or     tegra241_vintf_hw_init() runs. The cmdqv->vintfs[0] slot stays NULL until tegra241_cmdqv_init_structures()     first creates VINTF0, so the slot 0 read needs the same NULL check. Publish every slot with an     smp_store_release(), and read each slot in the ISR with an smp_load_acquire() under a NULL check, so the     ISR always sees a fully built vintf or NULL. Also make deinit_vintf() clear the slot, and     synchronize_irq() prior to returning idx to the IDA, so no vintf is freed under a running handler and no     reused idx is clobbered. (CVE-2026-90429)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
347587	Linux Distros Unpatched Vulnerability : CVE-2026-90429	Nessus	Misc.	9/18/2026	11/4/2026	high
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	10/12/2026	10/29/2026	high

Detections

Analytics

Plugins Search

high

high