A high-severity input validation vulnerability in the Linux kernel tegra241-cmdqv driver could allow a malicious guest to bypass Stream ID protections and achieve elevated system access.

This is an input validation vulnerability where the tegra241_vintf_init_vsid function fails to properly restrict the virtual Stream ID (vSID) width. An authenticated local attacker, acting as a guest virtual machine monitor, can provide a specially crafted vSID that aliases legitimate Stream IDs, leading to unauthorized memory or device access.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for full system compromise. Successful exploitation allows an attacker to bypass IOMMU protections, potentially leading to unauthorized data access, modification, or a complete denial of service for the host system. This represents a significant risk to virtualized environments and multi-tenant cloud infrastructures.

Immediate Action: Upgrade the Linux kernel to version 6.18.50, 7.2.4, or later versions where the fix has been implemented.

Proactive Monitoring: Monitor system logs for unusual IOMMU-related errors or unexpected guest-to-host communication patterns that might indicate exploitation attempts.

Compensating Controls: Ensure strict isolation policies for virtual machines and limit the privileges of guest environments where possible to minimize the attack surface.

Public Exploit Available: Unknown.

Given the severity of this vulnerability and its potential to compromise the isolation of virtualized environments, organizations should prioritize patching the Linux kernel across all affected hosts. Administrators must verify their current kernel versions against the fixed releases and schedule maintenance windows to apply the necessary security updates immediately to eliminate this risk.