CVE-2026-53044

soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

Published Jun 24, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables

Fix incorrect ARRAY_SIZE usage in fabric lookup tables which could
cause out-of-bounds access during target timeout lookup.

Analysis

Technical impact

The Linux kernel’s Tegra CBB fabric component contains an error in the calculation of array boundaries during a target timeout lookup, using an incorrect ARRAY_SIZE macro. This flaw permits the code path to read or write past the end of a fabric lookup table, resulting in kernel memory corruption that can cause crashes or denial of service. The vulnerability is a classic out‑of‑bounds read/write (CWE‑125) that could allow an attacker to subvert kernel integrity.

Affected Systems

The vulnerability affects the Linux kernel on Tegra platforms that include the CBB fabric module and have not yet incorporated the upstream fix (commit 5c009a5f8bb3c81f2cfb511701ce571e3c8733cd). No specific kernel release range is documented, so any install running legacy Tegra kernels should verify that the patch has been applied or that the offending module is not loaded.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate to high severity, while an EPSS score of less than 1% shows a very low current likelihood of exploitation. The likely attack vector is local access; based on the description, it is inferred that exploitation requires local access to reach the improperly calculated array indices, making remote exploitation unlikely. The CVE is not listed in the CISA KEV catalog, but the kernel memory corruption potential warrants prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`25de5c8fe0801361182b41c42f086bd089feda14`	affected	< f46870b451f7583802ed26eec8b93e138840fcd9
`25de5c8fe0801361182b41c42f086bd089feda14`	affected	< 5c009a5f8bb3c81f2cfb511701ce571e3c8733cd
`25de5c8fe0801361182b41c42f086bd089feda14`	affected	< 499f7e5ebbdd9ff0c4d532b1c432f8a61ff585b3

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[25de5c8fe0801361182b41c42f086bd089feda14,f46870b451f7583802ed26eec8b93e138840fcd9)`	affected	code_commit	—
`[25de5c8fe0801361182b41c42f086bd089feda14,5c009a5f8bb3c81f2cfb511701ce571e3c8733cd)`	affected	code_commit	—
`[25de5c8fe0801361182b41c42f086bd089feda14,499f7e5ebbdd9ff0c4d532b1c432f8a61ff585b3)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	semver	—
`[6.18.33,6.19.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the upstream patch for Tegra CBB fabric (commit 5c009a5f8bb3c81f2cfb511701ce571e3c8733cd).
If an immediate kernel update is not possible, disable the CBB fabric target‑timeout feature through kernel configuration or runtime settings to prevent the out‑of‑bounds path from being exercised.
If neither an update nor a configuration change is feasible, apply the corrective patch from the commit that fixes the ARRAY_SIZE issue to the kernel source, rebuild the affected module, and load it into the running kernel.

Generated by OpenCVE AI on August 12, 2026 at 07:04 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.164% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/499f7e5ebbdd9ff0c4d532b1c432f8a61ff585b3
https://git.kernel.org/stable/c/5c009a5f8bb3c81f2cfb511701ce571e3c8733cd
https://git.kernel.org/stable/c/f46870b451f7583802ed26eec8b93e138840fcd9
https://lore.kernel.org/linux-cve-announce/2026062457-CVE-2026-53044-d664@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53044
https://www.cve.org/CVERecord?id=CVE-2026-53044

History

Jun 28, 2026 8:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Jun 26, 2026 4:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-122

Jun 26, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-131
References		https://lore.kernel.org/linux-cve-announce/2026062457-CVE-2026-53044-d664@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53044 https://www.cve.org/CVERecord?id=CVE-2026-53044
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 24, 2026 9:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-122

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables Fix incorrect ARRAY_SIZE usage in fabric lookup tables which could cause out-of-bounds access during target timeout lookup.
Title		soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tables
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/499f7e5ebbdd9ff0c4d532b1c432f8a61ff585b3 https://git.kernel.org/stable/c/5c009a5f8bb3c81f2cfb511701ce571e3c8733cd https://git.kernel.org/stable/c/f46870b451f7583802ed26eec8b93e138840fcd9