Cloudanix VulnDB

CVE-2026-80883

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in the graphics driver for certain hardware can let programs try to use the graphics hardware before it is fully ready, which may cause crashes or errors.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in the Tegra DRM gr2d/gr3d driver where host1x_client_register exposes the device to userspace before the address register map initialization loop completes, allowing job submissions against an uninitialized map.

Why it matters to the business

Systems using affected Tegra hardware may experience graphics driver crashes, failed rendering, or unexpected kernel behavior when userspace graphics applications start immediately after driver load.

How an attack unfolds

An attacker with local access launches a graphics workload or userspace process that rapidly submits a job through the newly registered host1x client, hitting the window before register map initialization finishes and triggering undefined behavior in the kernel driver.

How to fix it

Apply the upstream kernel patch that relocates the register map initialization loop before the host1x_client_register call; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the source contains the initialization loop before the host1x_client_register invocation; verify the running kernel was built from a tree containing the reordered initialization code.

Typical attack path

  1. Obtain local execution on a system with the vulnerable Tegra DRM driver loaded
  2. Time a job submission to occur immediately after host1x_client_register returns but before the register map loop finishes
  3. Cause the kernel to dereference or use the uninitialized address map, leading to crash or memory corruption

How to detect it

Inspect kernel logs around drm/tegra and host1x client registration events for any oops or warnings occurring during early device initialization; correlate with userspace graphics process starts.

What your security team should do

  • Prioritize kernel updates on any Tegra-based Linux deployments within the next patching cycle
  • Monitor graphics driver load sequences in test environments for premature client registration
  • Review downstream distributions for backported fixes once they become available

The record

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1x_client_register() function is called just prior to register map initialization loop, making the device available to userspace. This may result in userspace attempting to submits a job before the register map is initialized. Address this by moving register initialization before host1x client registration.

Affected packages

Ecosystem Package Introduced Fixed