Executive brief
A vulnerability in the Linux kernel's Tegra194 PCI driver can cause a system hang or timeout during specific hardware reset sequences. This occurs when the system attempts to access hardware registers before the PCIe controller has been fully powered on. While primarily a stability issue, it could impact the availability of systems using NVIDIA Tegra194 processors.
Technical details
A sequencing error in the pcie-tegra194.c driver leads to a Control Backbone (CBB) timeout when the PERST# signal is deasserted twice. The root cause is that pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are invoked before reset_control_deassert(), resulting in an attempted write to the PCIE_MISC_CONTROL_1_OFF register (offset 0x8bc) while the hardware is not yet operational. This is a local vulnerability requiring specific hardware interaction or driver state transitions. The fix involves reordering the function calls to ensure the controller core is powered on before any DBI register accesses occur. Patches have been merged into various stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel 6.11.11 to 6.12, 6.12.2 to 6.12.91, 6.13
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory