CVE-2026-53051: Tegra194 PCIe Endpoint CBB Timeout on Reset – Linux Kernel Vulnerability

Technical summary

CVE-2026-53051 is a timing-sensitive flaw in the Tegra194 PCIe endpoint controller driver (drivers/pci/controller/dwc/pcie-tegra194.c). The vulnerability arises from an incorrect call ordering in the PCI endpoint reset flow. When PERST# (PCI reset signal) undergoes a deassert-assert-deassert cycle, the pex_ep_event_pex_rst_deassert() handler invokes pci_epc_deinit_notify() and subsequently dw_pcie_ep_cleanup() before reset_control_deassert(pcie->core_rst) has powered on the controller core. These cleanup operations eventually call dw_pcie_dbi_ro_wr_en(), which attempts to write to the DBI register at offset 0x8bc (PCIE_MISC_CONTROL_1_OFF). Since DBI registers are only accessible after core power-up, accessing them beforehand triggers a Control Backbone (CBB) timeout exception. The fix repositions the cleanup calls to execute after reset_control_deassert(), guaranteeing the core is operational before any DBI access occurs.

Business impact

This vulnerability primarily affects systems using Tegra194 SoCs in PCIe endpoint mode. The CBB timeout can cause kernel panics or system hangs during PCI reset sequences, disrupting device availability. For embedded systems, automotive platforms, or data center equipment utilizing Tegra194-based PCIe endpoints, the hang can be triggered by reset cycles initiated during initialization, recovery procedures, or hot-plug events. While not directly exploitable for unauthorized access, the denial-of-service impact can prevent legitimate device operation or complicate troubleshooting of PCIe configuration issues.

Affected systems

The vulnerability is specific to Linux kernel implementations on systems featuring the NVIDIA Tegra194 SoC configured as a PCIe endpoint. This includes embedded platforms, specialized automotive controllers, and edge computing devices that rely on Tegra194 for PCI Express endpoint functionality. Affected kernel versions are those before the fix is applied; organizations should verify exact vulnerable versions through their Linux distribution or custom kernel maintainers. The flaw does not affect systems using Tegra194 in PCIe root complex mode or non-Tegra platforms.

Exploitability

Exploitation requires local access to trigger PCI reset sequences. The attacker must have the ability to initiate PERST# toggles, which typically requires either direct hardware access, PCIe bus manipulation privileges, or root-level control of power-management or PCIe configuration utilities. The vulnerability is not remotely exploitable and does not provide privilege escalation or data exfiltration capabilities. It functions as a denial-of-service vector when triggered, causing system unresponsiveness rather than system compromise.

Remediation

The fix involves reordering the PCI endpoint reset handler to call reset_control_deassert(pcie->core_rst) before invoking pci_epc_deinit_notify() and dw_pcie_ep_cleanup(). This ensures the controller core is fully powered and the DBI register interface is accessible before any initialization or cleanup code attempts to access those registers. The patch is minimal and surgical, affecting only the call sequence in the reset event handler without modifying core PCI or DBI logic.

Patch guidance

Apply the kernel patch that reorders reset_control_deassert() to precede the epc deinit and cleanup calls in the Tegra194 PCIe endpoint reset handler. Organizations using Tegra194-based systems should monitor their Linux distribution or custom kernel sources for this fix and apply it during the next scheduled update cycle. Verify the patch is present in kernel versions released after the fix date (check against upstream linux-next or stable kernel releases for Tegra194 support). For custom or vendor-specific kernels, contact your platform provider to confirm inclusion of this fix.

Detection guidance

Monitor system logs for CBB timeout errors or kernel panics occurring at PCI reset time, particularly during system initialization or PCIe recovery sequences. Look for stack traces mentioning pcie-tegra194, pci_epc_deinit_notify(), or DBI register accesses (offset 0x8bc) followed by hardware errors. On affected systems, repeated PCI reset cycles or attempts to hot-plug PCIe endpoints may consistently trigger timeouts. Test PCIe reset behavior in non-production environments to identify vulnerable kernel versions before they impact production deployments.

Why prioritize this

This is a MEDIUM severity denial-of-service vulnerability with limited scope (Tegra194-specific) but potentially high impact for affected platforms. While not remotely exploitable and requiring local access, it can render PCIe endpoints inoperable, disrupting devices that depend on PCI reset recovery or configuration workflows. Organizations running Tegra194 systems in mission-critical roles should prioritize patching; others may defer to standard update cycles. The fix is low-risk and straightforward.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low complexity, low privilege requirement, and high availability impact with no confidentiality or integrity loss. The score appropriately captures the denial-of-service nature of the flaw while acknowledging that exploitation requires local access and only affects specific hardware platforms. The score would be lower if the flaw were non-reproducible, but the timing-sensitive nature makes it reliably triggerable when reset sequences occur.

Frequently asked questions