CVE-2026-53310: Linux Kernel Privilege Escalation Flaw

CVE-2026-53310 Overview

CVE-2026-53310 is a Linux kernel vulnerability in the NVIDIA Tegra Control Backbone (CBB) driver located under soc/tegra. The flaw resides in the cross-fabric target timeout lookup logic. When one fabric receives an error interrupt originating from a different fabric, the driver dereferences the wrong base address (cbb->regs) using offsets from another fabric's target map. This mismatch triggers a kernel paging request failure inside tegra234_cbb_get_tmo_slv, called from print_err_notifier during tegra234_cbb_isr interrupt handling. The result is a kernel oops and denial of service on affected Tegra234-based systems.

Critical Impact
A cross-fabric error interrupt causes a kernel page fault at an invalid virtual address, leading to a kernel crash and denial of service on Tegra234 platforms.

Affected Products

Linux kernel versions containing the soc/tegra: cbb driver prior to the fix commits
NVIDIA Tegra234-based systems using the CBB (Control Backbone) driver
Downstream distribution kernels that ship the affected tegra234_cbb driver

Discovery Timeline

2026-06-26 - CVE-2026-53310 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53310

Vulnerability Analysis

The vulnerability is a Null Pointer Dereference / Out-of-Bounds Read class kernel fault in the Tegra CBB (Control Backbone) driver. The CBB driver services error interrupts across multiple interconnect fabrics on Tegra234 SoCs. When an interrupt fires on one fabric but reports an error condition traced to a different fabric, the interrupt service routine must resolve the originating fabric before probing timeout registers.

The original implementation used the local fabric's cbb->regs base address in combination with a target-map offset that belonged to the remote fabric. Because the target map layout differs between fabrics, the computed address landed in unmapped kernel virtual memory. Accessing this address produced the trace:

Unable to handle kernel paging request at virtual address ffff80000954cc00
pc : tegra234_cbb_get_tmo_slv+0xc/0x28
Call trace:
 tegra234_cbb_get_tmo_slv+0xc/0x28
 print_err_notifier+0x6c0/0x7d0
 tegra234_cbb_isr+0xe4/0x1b4

The upstream patch introduces tegra234_cbb_get_fabric() to resolve the correct fabric device by fab_id and uses that fabric's base address for target timeout register access.

Root Cause

The root cause is incorrect base-address selection during cross-fabric error handling. The tegra234_cbb_isr handler assumed the reporting fabric owned the target-map offsets, but the CBB architecture allows one fabric's interrupt to reference targets on another fabric. Combining a mismatched base and offset produced an invalid MMIO address dereferenced in kernel context.

Attack Vector

Exploitation requires the hardware condition of a cross-fabric error interrupt on a Tegra234 SoC. The issue is triggered by system-level interconnect errors rather than direct attacker input over the network. Impact is limited to denial of service through kernel panic. No memory corruption or privilege escalation primitive has been reported.

See the upstream fixes: Linux Kernel Commit 8445d69, Linux Kernel Commit a5f51b04, and Linux Kernel Commit c892d0d4.

Detection Methods for CVE-2026-53310

Indicators of Compromise

Kernel oops messages referencing tegra234_cbb_get_tmo_slv in the call trace
Unable to handle kernel paging request errors originating from tegra234_cbb_isr
Unexpected system resets or hangs on Tegra234-based platforms following interconnect errors

Detection Strategies

Parse dmesg and persistent kernel logs for the signature call chain tegra234_cbb_isr → print_err_notifier → tegra234_cbb_get_tmo_slv
Inventory running kernel versions on Tegra234 hardware and compare against the fixed stable commits
Correlate crash reports with CBB error notifier activity in kernel ring buffer captures

Monitoring Recommendations

Forward kernel logs from Tegra234 devices to a centralized logging platform for pattern matching on CBB fault signatures
Alert on repeated kernel paging request events tied to the soc/tegra subsystem
Track patch level of affected embedded and edge Linux devices in asset inventory

How to Mitigate CVE-2026-53310

Immediate Actions Required

Identify all Tegra234-based systems running Linux kernels that include the vulnerable tegra234_cbb driver
Apply the upstream kernel patches that introduce tegra234_cbb_get_fabric() for correct fabric resolution
Rebuild and redeploy custom kernel images used on embedded and automotive Tegra234 devices

Patch Information

The fix is available in the mainline Linux kernel through three stable commits: 8445d69a5cabd8d6cb2bf0f8b798be205f53afa2, a5f51b04cbb3ae0f9cb2c4488952b775ebb0ccbf, and c892d0d4fe5ec05d3fdfb1616c3c0e3c12ef5abc. Each commit adds tegra234_cbb_get_fabric() and updates the target timeout lookup path to reference the correct fabric's base address. Downstream distributions and vendor BSPs should backport all three commits.

Workarounds

Where patching is not immediately possible, minimize workloads that exercise cross-fabric interconnect paths on Tegra234 SoCs
Disable the CBB error notifier only if operationally acceptable, understanding this reduces diagnostic visibility
Restrict physical and administrative access to affected devices to reduce exposure to conditions that trigger interconnect faults

bash

# Verify kernel version and confirm the CBB fix is present
uname -r
grep -R "tegra234_cbb_get_fabric" /usr/src/linux-$(uname -r)/drivers/soc/tegra/ 2>/dev/null