GHSA-CW7R-PVX8-2V7H
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-06-24 18:32In the Linux kernel, the following vulnerability has been resolved:
PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on
When PERST# is deasserted twice (assert -> deassert -> assert -> deassert), a CBB (Control Backbone) timeout occurs at DBI register offset 0x8bc (PCIE_MISC_CONTROL_1_OFF). This happens because pci_epc_deinit_notify() and dw_pcie_ep_cleanup() are called before reset_control_deassert() powers on the controller core.
The call chain that causes the timeout:
pex_ep_event_pex_rst_deassert() pci_epc_deinit_notify() pci_epf_test_epc_deinit() pci_epf_test_clear_bar() pci_epc_clear_bar() dw_pcie_ep_clear_bar() __dw_pcie_ep_reset_bar() dw_pcie_dbi_ro_wr_en() <- Accesses 0x8bc DBI register reset_control_deassert(pcie->core_rst) <- Core powered on HERE
The DBI registers, including PCIE_MISC_CONTROL_1_OFF (0x8bc), are only accessible after the controller core is powered on via reset_control_deassert(pcie->core_rst). Accessing them before this point results in a CBB timeout because the hardware is not yet operational.
Fix this by moving pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to after reset_control_deassert(pcie->core_rst), ensuring the controller is fully powered on before any DBI register accesses occur.
{
"affected": [],
"aliases": [
"CVE-2026-53051"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:17Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: tegra194: Fix CBB timeout caused by DBI access before core power-on\n\nWhen PERST# is deasserted twice (assert -\u003e deassert -\u003e assert -\u003e deassert),\na CBB (Control Backbone) timeout occurs at DBI register offset 0x8bc\n(PCIE_MISC_CONTROL_1_OFF). This happens because pci_epc_deinit_notify()\nand dw_pcie_ep_cleanup() are called before reset_control_deassert() powers\non the controller core.\n\nThe call chain that causes the timeout:\n\n pex_ep_event_pex_rst_deassert()\n pci_epc_deinit_notify()\n pci_epf_test_epc_deinit()\n pci_epf_test_clear_bar()\n pci_epc_clear_bar()\n dw_pcie_ep_clear_bar()\n __dw_pcie_ep_reset_bar()\n dw_pcie_dbi_ro_wr_en() \u003c- Accesses 0x8bc DBI register\n reset_control_deassert(pcie-\u003ecore_rst) \u003c- Core powered on HERE\n\nThe DBI registers, including PCIE_MISC_CONTROL_1_OFF (0x8bc), are only\naccessible after the controller core is powered on via\nreset_control_deassert(pcie-\u003ecore_rst). Accessing them before this point\nresults in a CBB timeout because the hardware is not yet operational.\n\nFix this by moving pci_epc_deinit_notify() and dw_pcie_ep_cleanup() to\nafter reset_control_deassert(pcie-\u003ecore_rst), ensuring the controller is\nfully powered on before any DBI register accesses occur.",
"id": "GHSA-cw7r-pvx8-2v7h",
"modified": "2026-06-24T18:32:45Z",
"published": "2026-06-24T18:32:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53051"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/010983063a806720b45778d191335f8ea864fea3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/34b3eef48d980cd37b876e128bbf314f69fb5d70"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b059a41bdd5b202b2b9d7708403fb43c69689e53"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce899f9c019591b73ef84b9afa332ed53beece25"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.