{"id":"CVE-2026-53045","state":"PUBLISHED","title":"memory: tegra124-emc: Fix dll_change check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra124-emc: Fix dll_change check\n\nThe code checking whether the specified memory timing enables DLL\nin the EMRS register was reversed. DLL is enabled if bit A0 is low.\nFix the check.","publishedAt":"2026-06-24T16:29:51.795Z","updatedAt":"2026-08-05T12:32:52.914Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"a85967331144fde9300be38bb44d2558eb6b742e","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"db0ae80865b515cc0b705c85877ec00f7eebe9fe","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"2369b1831161356e1bcb51385d3e532dc4fe2771","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"7e19e72f306484996c52ff96cc92f69b78ed5435","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"05f138fc7e27ee8e7a83ccf966c3fa26cda44dda","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"1793249c067a4b28e1aba0ad0e4d73aa9f9e165a","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"1ebbbef47d11cc90219c081492ccf995aaa3e9b3","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"9597ab9a8296ab337e6820f8a717ff621078b632","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/memory/tegra/tegra124-emc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.2","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.141","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.91","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/memory/tegra/tegra124-emc.c"]}],"references":["https://git.kernel.org/stable/c/a85967331144fde9300be38bb44d2558eb6b742e","https://git.kernel.org/stable/c/db0ae80865b515cc0b705c85877ec00f7eebe9fe","https://git.kernel.org/stable/c/2369b1831161356e1bcb51385d3e532dc4fe2771","https://git.kernel.org/stable/c/7e19e72f306484996c52ff96cc92f69b78ed5435","https://git.kernel.org/stable/c/05f138fc7e27ee8e7a83ccf966c3fa26cda44dda","https://git.kernel.org/stable/c/1793249c067a4b28e1aba0ad0e4d73aa9f9e165a","https://git.kernel.org/stable/c/1ebbbef47d11cc90219c081492ccf995aaa3e9b3","https://git.kernel.org/stable/c/9597ab9a8296ab337e6820f8a717ff621078b632"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53045.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53045","state":"PUBLISHED","datePublished":"2026-06-24T16:29:51.795Z","dateUpdated":"2026-08-05T12:32:52.914Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-06-09T07:44:35.381Z"},"containers":{"cna":{"title":"memory: tegra124-emc: Fix dll_change check","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra124-emc: Fix dll_change check\n\nThe code checking whether the specified memory timing enables DLL\nin the EMRS register was reversed. DLL is enabled if bit A0 is low.\nFix the check."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"a85967331144fde9300be38bb44d2558eb6b742e","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"db0ae80865b515cc0b705c85877ec00f7eebe9fe","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"2369b1831161356e1bcb51385d3e532dc4fe2771","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"7e19e72f306484996c52ff96cc92f69b78ed5435","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"05f138fc7e27ee8e7a83ccf966c3fa26cda44dda","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"1793249c067a4b28e1aba0ad0e4d73aa9f9e165a","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"1ebbbef47d11cc90219c081492ccf995aaa3e9b3","versionType":"git"},{"version":"73a7f0a90641b09300d47308682b674c570dd6a2","status":"affected","lessThan":"9597ab9a8296ab337e6820f8a717ff621078b632","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/memory/tegra/tegra124-emc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.2","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.141","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.91","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/memory/tegra/tegra124-emc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a85967331144fde9300be38bb44d2558eb6b742e"},{"url":"https://git.kernel.org/stable/c/db0ae80865b515cc0b705c85877ec00f7eebe9fe"},{"url":"https://git.kernel.org/stable/c/2369b1831161356e1bcb51385d3e532dc4fe2771"},{"url":"https://git.kernel.org/stable/c/7e19e72f306484996c52ff96cc92f69b78ed5435"},{"url":"https://git.kernel.org/stable/c/05f138fc7e27ee8e7a83ccf966c3fa26cda44dda"},{"url":"https://git.kernel.org/stable/c/1793249c067a4b28e1aba0ad0e4d73aa9f9e165a"},{"url":"https://git.kernel.org/stable/c/1ebbbef47d11cc90219c081492ccf995aaa3e9b3"},{"url":"https://git.kernel.org/stable/c/9597ab9a8296ab337e6820f8a717ff621078b632"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - On networked Tegra124 devices, unauthenticated remote traffic can induce memory/CPU load that drives ACTMON/devfreq EMC rate transitions into the vulnerable timing-change path.\nAC:L - Once running on an affected Tegra124 DDR3 configuration with timings that cross the DLL enable boundary, the attacker only needs to induce rate changes; there is no race or hard-to-control memory layout requirement.\nPR:N - The remote-load ACTMON/devfreq path has no authentication or privilege check before the vulnerable EMC clock transition is reached.\nUI:N - No victim action is required; rate changes are performed automatically by kernel power-management code in response to load.\nS:U - The impact remains within the same kernel-controlled system and does not cross a hypervisor, IOMMU, or separate security-authority boundary.\nC:H - The reversed DLL transition handling can misprogram DDR3 timing/state during EMC clock changes, creating system-wide DRAM corruption that may expose arbitrary kernel or process memory.\nI:H - Incorrect DRAM DLL sequencing can corrupt arbitrary memory contents, including kernel data or page tables, making high integrity impact defensible.\nA:H - Bad memory-controller timing during live DRAM operation can hang, panic, or otherwise crash the system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:32:52.914Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.6.141"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.12.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}