CVE-2026-53051: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-53051 is a denial-of-service vulnerability in the Linux kernel's PCI tegra194 driver caused by premature DBI register access before the controller core is powered on. When PERST# is deasserted twice in succession, a CBB (Control Backbone) timeout occurs at DBI register offset 0x8bc (PCIE_MISC_CONTROL_1_OFF) because pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are invoked before reset_control_deassert(pcie->core_rst) powers on the controller core. The vulnerability affects Linux kernel versions 6.11.11 through pre-6.12, and 6.12.2 through pre-6.12.91, as well as kernel 6.13. It was published on June 24, 2026, with patches available in kernel versions 6.12.91, 6.18.33, 7.0.10, and 7.1. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.175% (GitHub Advisory, Feedly).

The root cause is an incorrect ordering of operations in the pex_ep_event_pex_rst_deassert() function within the tegra194 PCIe endpoint driver. When PERST# is deasserted a second time, the driver calls pci_epc_deinit_notify() → pci_epf_test_epc_deinit() → pci_epf_test_clear_bar() → pci_epc_clear_bar() → dw_pcie_ep_clear_bar() → __dw_pcie_ep_reset_bar() → dw_pcie_dbi_ro_wr_en(), which attempts to access DBI register 0x8bc — all before reset_control_deassert(pcie->core_rst) has powered on the controller core. Because the hardware is not yet operational at that point, the access results in a CBB timeout that can hang the system or trigger a kernel panic. No specific CWE has been formally assigned to this vulnerability (GitHub Advisory).

Successful triggering of this vulnerability results in a CBB timeout that can hang the system or cause a kernel panic, constituting a denial-of-service condition. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The affected scope is systems using NVIDIA Tegra194-based SoCs (e.g., Jetson AGX Xavier) configured as PCIe endpoints that undergo multiple PERST# assertion/deassertion cycles (Feedly, GitHub Advisory).

The fix reorders the reset handling code in the tegra194 PCI endpoint driver, moving pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to execute after reset_control_deassert(pcie->core_rst), ensuring the controller core is fully powered on before any DBI register accesses occur. Patched kernel versions include 6.12.91, 6.18.33, 7.0.10, and 7.1. Administrators running affected Tegra194-based systems should update to a patched kernel version as the primary remediation; no configuration-based workaround is documented (GitHub Advisory, Feedly).