CVE-2026-53051: Linux Kernel PCI Tegra194 Timeout Flaw

CVE-2026-53051 Overview

CVE-2026-53051 is a Linux kernel vulnerability in the pci-tegra194 PCIe controller driver. The flaw occurs when the PERST# signal is deasserted twice in sequence (assert → deassert → assert → deassert). Under this condition, the driver accesses DBI (Databus Interface) registers before the controller core is powered on via reset_control_deassert(). This triggers a Control Backbone (CBB) timeout at DBI register offset 0x8bc (PCIE_MISC_CONTROL_1_OFF). The defect affects NVIDIA Tegra194 platforms running affected Linux kernel versions and has been resolved upstream.

Critical Impact
Improper ordering of DBI register access before core power-on produces a CBB timeout, leading to denial of service on Tegra194 PCIe endpoint controllers.

Affected Products

Linux kernel pci-tegra194 driver (PCIe endpoint mode)
NVIDIA Tegra194 SoC platforms using upstream Linux kernel
Stable kernel branches prior to the commits referenced in the fix

Discovery Timeline

2026-06-24 - CVE-2026-53051 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53051

Vulnerability Analysis

The vulnerability resides in the pex_ep_event_pex_rst_deassert() function inside the Tegra194 PCIe endpoint driver. When PERST# is deasserted a second time, the driver invokes pci_epc_deinit_notify() and dw_pcie_ep_cleanup() before calling reset_control_deassert(pcie->core_rst). These cleanup paths reach dw_pcie_dbi_ro_wr_en(), which writes to the DBI register at offset 0x8bc. Because the controller core has not yet been powered on, the hardware is not operational and the access stalls on the Control Backbone fabric.

The full call chain producing the timeout is pex_ep_event_pex_rst_deassert() → pci_epc_deinit_notify() → pci_epf_test_epc_deinit() → pci_epf_test_clear_bar() → pci_epc_clear_bar() → dw_pcie_ep_clear_bar() → __dw_pcie_ep_reset_bar() → dw_pcie_dbi_ro_wr_en(). The result is a hardware fault that disrupts PCIe endpoint operation.

Root Cause

The root cause is an ordering defect in driver initialization logic. DBI registers, including PCIE_MISC_CONTROL_1_OFF at offset 0x8bc, are only accessible after the controller core leaves reset. The driver dispatched cleanup notifications that perform DBI writes prior to reset_control_deassert(pcie->core_rst), violating the hardware access contract.

Attack Vector

This is a local kernel-side defect triggered by repeated PERST# signal transitions on Tegra194 endpoint-mode PCIe hardware. There is no documented network attack vector or remote exploitation path. The defect is characterized as a denial-of-service condition affecting PCIe endpoint functionality rather than a memory-corruption or code-execution flaw.

No proof-of-concept exploit code is available for this vulnerability. Refer to the upstream kernel commits for the technical fix details.

Detection Methods for CVE-2026-53051

Indicators of Compromise

Kernel log messages reporting CBB (Control Backbone) timeouts referencing DBI offset 0x8bc on Tegra194 systems.
PCIe endpoint enumeration failures or controller hangs following repeated PERST# transitions.
Stack traces in dmesg showing dw_pcie_dbi_ro_wr_en() invoked from pex_ep_event_pex_rst_deassert() paths.

Detection Strategies

Audit running kernel versions on Tegra194-based platforms against the fixed commits referenced by upstream.
Monitor kernel ring buffers and serial console output for CBB timeout signatures during PCIe link transitions.
Inspect deployed kernels for the presence of the reordering patch in drivers/pci/controller/dwc/pcie-tegra194.c.

Monitoring Recommendations

Forward dmesg and journald logs from affected Tegra194 systems to a centralized logging platform for pattern matching on CBB timeout strings.
Track PCIe link state transitions and endpoint reinitialization events on embedded fleets.
Establish alerting on kernel oops or hang conditions tied to PCIe subsystem call stacks.

How to Mitigate CVE-2026-53051

Immediate Actions Required

Apply the upstream Linux kernel patches that move pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to execute after reset_control_deassert(pcie->core_rst).
Rebuild and redeploy kernels for Tegra194 endpoint-mode systems with the corrected driver ordering.
Validate PERST# handling by exercising repeated assert/deassert cycles in a test environment before production rollout.

Patch Information

The fix reorders the cleanup notifications so the controller core is powered on before any DBI register access occurs. Patches are available across multiple stable branches. See the upstream commits: 010983063a80, 34b3eef48d98, b059a41bdd5b, and ce899f9c0195.

Workarounds

Avoid workloads that drive repeated PERST# assert/deassert cycles on unpatched Tegra194 endpoint controllers.
Where feasible, restrict PCIe endpoint reinitialization to single-shot sequences until the kernel patch is applied.
Coordinate with hardware integrators on platforms that issue back-to-back PERST# transitions to defer such events until patched kernels are deployed.

bash

# Verify the patched commit is present in the running kernel source tree
git log --oneline drivers/pci/controller/dwc/pcie-tegra194.c | \
  grep -E '010983063a80|34b3eef48d98|b059a41bdd5b|ce899f9c0195'

# Confirm running kernel version after upgrade
uname -r