CVE-2024-53152 is a vulnerability identified in the Linux kernel specifically affecting the PCIe endpoint controller implementation for the NVIDIA Tegra194 SoC platform. The root cause stems from the timing and sequence of controller cleanup operations during the PCIe reset sequence. In the affected code, the cleanup functions dw_pcie_ep_cleanup() and pci_epc_deinit_notify() are invoked during the assertion of the PCIe reset signal (PERST#) from the host. However, shortly after this reset assertion, the host disables the reference clock (refclk) that the Tegra194 endpoint depends on to keep the PCIe controller operational. Since the cleanup functions require access to hardware registers, and these registers become inaccessible without the refclk, invoking these functions during reset assertion leads to a crash of the endpoint SoC. The vulnerability arises because the endpoint SoC design depends on the host-provided refclk, and the cleanup functions are called prematurely when the refclk is no longer active. The fix involves deferring the controller cleanup operations to the start of the PCIe reset deassertion event (pex_ep_event_pex_rst_deassert()), which is guaranteed to occur when the refclk is active again. By moving the cleanup to this later stage, the kernel avoids accessing hardware registers without a valid clock, preventing the endpoint crash. This vulnerability is specific to Tegra194-based endpoints and their PCIe controller handling within the Linux kernel. It does not affect all Linux systems but targets embedded or specialized devices using this SoC and kernel version. No known exploits are reported in the wild as of now, and no CVSS score has been assigned yet.

For European organizations, the impact of this vulnerability depends largely on the deployment of Tegra194-based embedded systems running Linux kernels with the affected PCIe controller code. Such devices may be found in industrial control systems, automotive infotainment, robotics, or specialized networking equipment. A crash of the endpoint SoC due to this vulnerability could lead to denial of service conditions, causing system instability or downtime. This could disrupt critical operations in manufacturing plants, transportation systems, or other infrastructure relying on these embedded devices. While the vulnerability does not directly lead to privilege escalation or data breach, the availability impact could be significant in environments where uptime and reliability are critical. Furthermore, recovery from such crashes may require manual intervention or system reboot, increasing operational costs and risk of cascading failures. Since the vulnerability requires the host to assert PERST# and disable refclk, exploitation is limited to scenarios where the host initiates PCIe reset sequences, which may be triggered during system updates or hardware resets. The absence of known exploits reduces immediate risk, but organizations using affected Tegra194 devices should prioritize patching to prevent potential denial of service incidents.

1. Apply the official Linux kernel patch that moves the PCIe controller cleanup functions to the reset deassertion phase as described in the fix for CVE-2024-53152. This is the definitive solution to prevent endpoint crashes. 2. Identify and inventory all devices running Tegra194 SoCs or similar endpoint hardware that rely on host-provided refclk for PCIe operation. 3. For embedded systems where kernel updates are challenging, consider isolating or controlling PCIe reset signals from the host to avoid triggering the vulnerable cleanup sequence. 4. Monitor system logs and hardware status for signs of unexpected PCIe endpoint crashes or resets, which could indicate attempts to exploit this vulnerability. 5. Coordinate with device vendors and embedded system integrators to ensure firmware and kernel versions include this fix. 6. Implement robust recovery procedures to minimize downtime if endpoint crashes occur, including automated reboot scripts and alerting mechanisms. 7. Where possible, evaluate hardware designs to generate refclk internally on the endpoint to reduce dependency on host clocks, mitigating similar issues in future designs.