Skip to main content

Linux Kernel EUVDEUVD-2026-38919

| CVE-2026-53051 MEDIUM
2026-06-24 Linux GHSA-cw7r-pvx8-2v7h
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privileges required to trigger PERST# cycling on Tegra194 PCIe endpoint hardware; pure availability impact with no confidentiality or integrity effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 19:46 vuln.today
CVSS changed
Jul 21, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on

When PERST

is deasserted twice (assert -> deassert -> assert -> deassert),

a CBB (Control Backbone) timeout occurs at DBI register offset 0x8bc (PCIE_MISC_CONTROL_1_OFF). This happens because pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert() powers on the controller core.

The call chain that causes the timeout:

pex_ep_event_pex_rst_deassert() pci_epc_deinit_notify() pci_epf_test_epc_deinit() pci_epf_test_clear_bar() pci_epc_clear_bar() dw_pcie_ep_clear_bar() __dw_pcie_ep_reset_bar() dw_pcie_dbi_ro_wr_en() <- Accesses 0x8bc DBI register reset_control_deassert(pcie->core_rst) <- Core powered on HERE

The DBI registers, including PCIE_MISC_CONTROL_1_OFF (0x8bc), are only accessible after the controller core is powered on via reset_control_deassert(pcie->core_rst). Accessing them before this point results in a CBB timeout because the hardware is not yet operational.

Fix this by moving pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to after reset_control_deassert(pcie->core_rst), ensuring the controller is fully powered on before any DBI register accesses occur.

AnalysisAI

Operation sequencing flaw in the Linux kernel's tegra194 PCIe endpoint driver causes a Control Backbone (CBB) timeout when PERST

is deasserted twice in succession. During the second deassert cycle, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() - which access DBI register PCIE_MISC_CONTROL_1_OFF at offset 0x8bc - before reset_control_deassert() powers on the PCIe controller core, triggering a hardware bus timeout and denying availability of the PCIe subsystem. With an EPSS of 0.18% (7th percentile), no CISA KEV listing, and hardware-specific scope limited to NVIDIA Tegra194 SoCs, this is a low-probability exploitation target with real-world impact confined to embedded and automotive Linux deployments.

Technical ContextAI

The vulnerability resides in the pex_ep_event_pex_rst_deassert() function of drivers/pci/controller/dwc/pcie-tegra194.c in the Linux kernel, which handles PCIe endpoint (EP) mode on NVIDIA Tegra194 SoCs. The DesignWare PCIe (dw_pcie) subsystem manages the PCIe Data Bus Interface (DBI) register space, including PCIE_MISC_CONTROL_1_OFF at offset 0x8bc, which is only accessible after the controller core is powered on via reset_control_deassert(pcie->core_rst). The root cause is an incorrect call ordering in the PERST

deassert handler: cleanup routines that require live DBI access are scheduled before the hardware power-on sequence completes. While no CWE is formally assigned, this maps conceptually to improper initialization ordering (analogous to CWE-908 or CWE-696). The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches including 6.11.x, 6.12.x, and 7.x.

RemediationAI

Update the Linux kernel to a patched stable release: 6.12.91, 7.0.10, 7.1, or 6.18.33 per EUVD-2026-38919. Upstream stable fixes are available at https://git.kernel.org/stable/c/010983063a806720b45778d191335f8ea864fea3, https://git.kernel.org/stable/c/b059a41bdd5b202b2b9d7708403fb43c69689e53, https://git.kernel.org/stable/c/ce899f9c019591b73ef84b9afa332ed53beece25, and https://git.kernel.org/stable/c/34b3eef48d980cd37b876e128bbf314f69fb5d70. Ubuntu users should apply USN-8568-1 or USN-8566-1 via standard package management. As a compensating control prior to patching, operators of Tegra194-based systems can disable PCIe endpoint (EP) mode if not required for the use case - this eliminates the vulnerable code path entirely but removes PCIe EP functionality. Alternatively, suppressing double PERST

cycling at the firmware or hardware level (if configurable) prevents the triggering condition, though this may not be feasible in all deployment scenarios.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38919 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy