Look up another CVE · open CVE-2026-53044 in the interactive tracker
CVE-2026-53044
soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables
Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem drivers/soc. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53044 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.10-1 | Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Fix incorrect ARRAY_SIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/soc/tegra/cbb/tegra234-cbb.c
- What this is
- THE RESTMAINTAINERS section matched on */ · linux-kernel@vger.kernel.org · Buried alive in reporters
Check it on the machine
grep -wE 'CONFIG_ARCH_TEGRA|CONFIG_ARCH_TEGRA_234_SOC|CONFIG_SOC_TEGRA_CBB' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.
- bookworm, trixien
- forky, sidYnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- n
- not enabled on any flavour - this release does not build the code
- Y
- built in where it is built at all; some flavours do not build it
- Build switches
- CONFIG_ARCH_TEGRA, CONFIG_ARCH_TEGRA_234_SOC, CONFIG_SOC_TEGRA_CBB
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-24 (4 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/soc
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.17 | 6.18.33 | f46870b451f7 |
| 6.17 | 7.0.10 | 5c009a5f8bb3 |
| 6.17 | 7.1 | 499f7e5ebbdd |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable Tegra CBB timeout decoding runs on local SoC fabric error handling paths, reached through local device/accelerator activity or local debugfs inspection of pending CBB status rather than network packets.
- AC:LAttack complexity, low
- Once a timeout error with the affected fabric and target ID is generated, the bad bounds check deterministically permits the out-of-bounds lookup; there is no race or probabilistic exploitation step.
- PR:LPrivileges required, low
- In the most severe reasonable Tegra deployment, an unprivileged local user can interact with device/accelerator interfaces capable of causing fabric transactions and CBB error reporting. Real init-namespace root is not inherently required by the vulnerable decode path.
- UI:NUser interaction, none
- No victim user action is required after the attacker triggers the local fabric error condition; the interrupt handler processes the error automatically.
- S:UScope, unchanged
- The impact remains within the same kernel/SoC security authority and does not cross a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- The incorrect ARRAY_SIZE permits out-of-bounds reads from kernel lookup data and pointer dereferences during error printing. Under the required conservative rule for out-of-bounds reads, this is scored as high confidentiality impact.
- I:NIntegrity impact, none
- The vulnerable path reads lookup entries and MMIO timeout status but does not provide an out-of-bounds write or a clear primitive for modifying kernel data.
- A:HAvailability impact, high
- The out-of-bounds lookup can dereference invalid data or perform bogus MMIO reads while handling the CBB error, plausibly causing a kernel oops or panic.