In the Linux kernel’s iOMMU Tegra241 command queue driver, a guest‑controlled virtual Stream ID can exceed the 20‑bit field imposed by the hardware. When the value is written to the SID_MATCH register, bits above the allowed width are discarded, producing a match value that refers to a different Stream ID. Because the driver performs only a maximum unsigned integer check (CWE‑681), it fails to reject wide values, allowing a virtual machine monitor to create stream entries that alias an unintended Stream ID and potentially redirect or leak data among virtual devices. The flaw does not grant direct code execution, yet it can compromise the confidentiality or integrity of traffic handled by the affected device. Based on the description, it is inferred that the likely attack vector is the hypervisor manipulating guest‑provided vdev->virt_id, or a compromised guest that can influence this value.

The weakness resides in the Linux kernel driver for Tegra241 IOMMU devices (iommu/tegra241‑cmdqv). It applies to any system running the affected kernel code before the fix is applied; specific all kernels containing the commit before the fix should be considered vulnerable.

The CVSS score of 8.8 denotes a high severity, and the EPSS score of <1% indicates a very low exploitation probability, although no proof of active exploitation exists. The vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is the hypervisor manipulating guest‑controlled vSID values. An attacker that controls the virtual machine monitor can trigger the bug and establish a persistent mismatch in Stream ID mapping, affecting neighboring virtual devices. The existence of a vulnerable driver without a public exploit means the risk to environments where untrusted VMs share the same physical hardware is currently theoretical, but the potential impact warrants urgent remediation.