Skip to main content

Linux Kernel EUVDEUVD-2026-39845

| CVE-2026-53310 MEDIUM
2026-06-26 Linux GHSA-fpxp-9g9j-vhm7
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required; only kernel availability impacted via page fault crash; no confidentiality or integrity impact confirmed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:33 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

soc/tegra: cbb: Fix cross-fabric target timeout lookup

When a fabric receives an error interrupt, the error may have occurred on a different fabric. The target timeout lookup was using the wrong base address (cbb->regs) with offsets from a different fabric's target map, causing a kernel page fault.

Unable to handle kernel paging request at virtual address ffff80000954cc00 pc : tegra234_cbb_get_tmo_slv+0xc/0x28 Call trace: tegra234_cbb_get_tmo_slv+0xc/0x28 print_err_notifier+0x6c0/0x7d0 tegra234_cbb_isr+0xe4/0x1b4

Add tegra234_cbb_get_fabric() to look up the correct fabric device using fab_id, and use its base address for accessing target timeout registers.

AnalysisAI

Kernel page fault in the Linux kernel's Tegra234 Control Backbone (CBB) driver crashes affected NVIDIA Tegra234-based systems when a cross-fabric error interrupt triggers incorrect register address resolution. The tegra234_cbb_get_tmo_slv() function uses the receiving fabric's base address (cbb->regs) with register offsets derived from a different fabric's target map, producing an invalid virtual address dereference (ffff80000954cc00) and a kernel panic. Exploitation requires local low-privilege access to Tegra234 hardware; no public exploit or POC exists, EPSS sits at the 5th percentile (0.15%), and the vulnerability is not in CISA KEV.

Technical ContextAI

The Tegra234 CBB (Control Backbone Bridge) is NVIDIA's on-chip interconnect fabric used in Jetson AGX Orin and Drive AGX Orin SoCs. The kernel driver monitors fabric error conditions via tegra234_cbb_isr, which calls print_err_notifier and ultimately tegra234_cbb_get_tmo_slv to resolve the timed-out slave device. When an error originates on a fabric different from the one that raised the interrupt, the code incorrectly used the interrupt-handling fabric's base address (cbb->regs) together with target-map offsets belonging to the originating fabric - producing a pointer to an unmapped virtual address. The fix introduces tegra234_cbb_get_fabric() to resolve the correct fabric struct from the fab_id field before performing register accesses. No CWE is formally assigned, but the root cause aligns with incorrect pointer/offset arithmetic (similar to CWE-823: Use of Out-of-range Pointer Offset). CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, scoped to Tegra234 platform kernels.

RemediationAI

Upgrade the kernel to a patched stable release: Linux 6.18.33, 7.0.10, or 7.1, all of which incorporate the corrective commits available at https://git.kernel.org/stable/. For Tegra234 platforms (Jetson AGX Orin, Drive AGX Orin) that cannot be updated immediately, restricting local user accounts and preventing unprivileged shell access reduces the realistic attack surface, since the CVSS vector requires PR:L. Note that the fault trigger depends on actual cross-fabric CBB error interrupt events, which under normal operating conditions arise from hardware anomalies rather than easily reproducible software actions; this limits practical exploitability even on unpatched systems. No workaround that disables the CBB interrupt handler is advisable in production, as it would suppress legitimate hardware error reporting.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39845 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy