CVE-2026-80883: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
In the Linux kernel, the following vulnerability has been resolved:
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
The host1xclientregister() function is called just prior to register map initialization loop, making the device available to userspace. This may result in userspace attempting to submits a job before the register map is initialized. Address this by moving register initialization before host1x client registration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the kernel fix in the DRM Tegra driver to initialize the address register map before the HOST1X client is registered (move register initialization before calling host1x_client_register()).
Event History
Frequently Asked Questions
Who is exposed to this race condition?
Systems using the Linux kernel Tegra DRM gr2d or gr3d drivers are exposed when the device becomes available to userspace before its address register map has finished initializing.
What must occur for the issue to be triggered?
Userspace must attempt to submit a gr2d or gr3d job during the initialization window after HOST1X client registration but before the register map initialization loop completes.
How can I tell whether my kernel includes the fix?
Check whether the Tegra gr2d/gr3d driver initializes its address register map before calling host1x_client_register(). The listed stable references identify commits containing the correction.