CVE-2026-80883: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered

Published Sep 4, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered

The host1xclientregister() function is called just prior to register map initialization loop, making the device available to userspace. This may result in userspace attempting to submits a job before the register map is initialized. Address this by moving register initialization before host1x client registration.

Affected Software

1 affected component
Linux Kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Apply the kernel fix in the DRM Tegra driver to initialize the address register map before the HOST1X client is registered (move register initialization before calling host1x_client_register()).

Event History

Sep 4, 2026
CVE Published
via MITRE·04:49 PM
Data Sourced
via MITRE·04:49 PM
Description
Data Sourced
via NVD·05:17 PM
Description

Frequently Asked Questions

1

Who is exposed to this race condition?

Systems using the Linux kernel Tegra DRM gr2d or gr3d drivers are exposed when the device becomes available to userspace before its address register map has finished initializing.

2

What must occur for the issue to be triggered?

Userspace must attempt to submit a gr2d or gr3d job during the initialization window after HOST1X client registration but before the register map initialization loop completes.

3

How can I tell whether my kernel includes the fix?

Check whether the Tegra gr2d/gr3d driver initializes its address register map before calling host1x_client_register(). The listed stable references identify commits containing the correction.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203