Executive brief
A vulnerability was identified in the Linux kernel's support for NVIDIA Tegra processors. When the system encounters certain hardware communication errors, the kernel may attempt to access an incorrect memory address, leading to a system crash (kernel page fault). This could allow a local user to cause a denial-of-service condition, impacting system availability.
Technical details
The vulnerability is a NULL pointer dereference or invalid memory access (kernel page fault) within the 'soc/tegra' subsystem, specifically in the 'tegra234-cbb.c' driver. When a fabric error interrupt occurs, the 'tegra234_sw_lookup_target_timeout' function incorrectly used the current fabric's base address ('cbb->regs') instead of the target fabric's base address when processing cross-fabric errors. This mismatch results in an invalid memory access during the target timeout lookup. The fix introduces 'tegra234_cbb_get_fabric()' to correctly identify the fabric device by its ID and use its specific base address for register access. Patches are available in stable kernel branches 6.18.33, 7.0.10, and 7.1.
Affected products
- Linux Linux Kernel 6.17 to 6.18.33, 7.0 to 7.0.10
Timeline
- 2026-01-21: disclosed: Initial patch authored by NVIDIA
- 2026-05-23: patched: Patch committed to stable kernel trees
- 2026-06-26: advisory: CVE-2026-53310 published by NVD