CVE-2026-53310: Tegra Linux Kernel Cross-Fabric Memory Lookup DoS

Technical summary

The vulnerability resides in the Tegra Cross-Bar interconnect (cbb) error handling code in the Linux kernel. When a fabric receives an error interrupt, the handler attempts to look up the target timeout register, but uses the wrong base address. Specifically, it references cbb->regs with offsets derived from a different fabric's target map, leading to an out-of-bounds memory access (kernel page fault at ffff80000954cc00). The fix introduces tegra234_cbb_get_fabric() to perform a proper fabric device lookup using the fabric ID (fab_id), ensuring the correct base address is used when accessing target timeout registers.

Business impact

For organizations deploying Tegra-based Linux systems (including some Android devices, Nvidia Jetson platforms, and embedded automotive/IoT applications), this vulnerability enables local denial-of-service attacks. A user with shell access can crash the kernel repeatedly, disrupting service availability. In production environments where Tegra systems handle critical functions (infotainment, telemetry, edge AI processing), such crashes may trigger cascading failures or safety concerns in automotive contexts. The impact is containable through standard privilege and access controls, but unpatched systems remain vulnerable to any local account holder.

Affected systems

Linux kernel versions containing the vulnerable Tegra cbb driver code (primarily affecting Tegra234 and related SoC variants). This includes custom kernels in NVIDIA Jetson devices, mobile platforms using Tegra processors, and embedded systems running Linux on these architectures. Desktop and server distributions are unaffected unless they include Tegra-specific device drivers.

Exploitability

Exploitability is moderate. The vulnerability requires local access (user login or shell) on a Tegra-based Linux system, making it unsuitable for remote attacks. However, the barrier to triggering the crash is low: triggering an error interrupt on a cross-fabric connection followed by querying error registers can crash the kernel. No special tools or elevated privileges are strictly necessary if the attacker can induce error conditions. The CVSS score of 5.5 (Medium) reflects the local-only attack vector but acknowledges the straightforward denial-of-service outcome.

Remediation

Apply a Linux kernel update that includes the fix to the Tegra cbb driver. The patch adds the tegra234_cbb_get_fabric() function to correctly identify and use the appropriate fabric's base address during target timeout lookups. Verify the patch against the vendor advisory or your kernel source tree to ensure the fix is present. No kernel parameters or workarounds are available; patching is the only mitigation.

Patch guidance

Identify your kernel version and determine if your distribution or system vendor has released an updated kernel that includes the Tegra cbb fix. For Jetson platforms, check NVIDIA's release notes and update to a patched JetPack version. For custom or embedded systems, verify that your kernel source includes the cross-fabric lookup fix before recompilation. Test in a staging environment to ensure the patch does not introduce regressions with your Tegra-based hardware.

Detection guidance

Monitor system logs for kernel page fault messages referencing tegra234_cbb_get_tmo_slv or cross-fabric error handling (tegra234_cbb_isr). Repeated kernel panics or oops messages related to the CBB driver may indicate exploitation attempts or underlying hardware issues triggering the bug. On Tegra systems, enable kernel crash dump collection (kdump) to preserve evidence of exploitation. Network-based detection is limited to observing sudden service unavailability on Tegra-based edge devices or embedded systems.

Why prioritize this

This vulnerability should be prioritized if your organization relies on Tegra-based Linux systems for production workloads. While the attack requires local access, the ease of triggering a crash and the availability of a straightforward fix make patching a clear operational necessity. Prioritize based on deployment scale: high for organizations with many Jetson or embedded Tegra deployments, moderate for those with selective Tegra use. The Medium CVSS score reflects the local-only requirement, but impact in embedded/automotive contexts may be higher due to service criticality.

Risk score, explained

CVSS 5.5 (Medium) combines a local attack vector (AV:L) and low attack complexity (AC:L) with high availability impact (A:H) but no confidentiality or integrity exposure. This appropriately reflects that any local user can crash the kernel without elevated privileges, but cannot read or modify data—they can only deny service. In environments where kernel stability is mission-critical (automotive, medical IoT), the practical risk may exceed the numerical score.

Frequently asked questions