CVE-2026-80883: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Compensating control
Apply the kernel fix in the DRM Tegra driver to initialize the address register map before the HOST1X client is registered (move register initialization before calling host1x_client_register()).
Event History
Frequently Asked Questions
Who is exposed to this race condition?
Systems using the Linux kernel Tegra DRM gr2d or gr3d drivers are exposed when the device becomes available to userspace before its address register map has finished initializing.
What must occur for the issue to be triggered?
Userspace must attempt to submit a gr2d or gr3d job during the initialization window after HOST1X client registration but before the register map initialization loop completes.
How can I tell whether my kernel includes the fix?
Check whether the Tegra gr2d/gr3d driver initializes its address register map before calling host1x_client_register(). The listed stable references identify commits containing the correction.