HIGH Introduced in 3.10
tegra gr2d RegisterMap Race
CVE-2026-80883
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1x_client_register() function is called just prior to register map initialization loop, making the device available to userspace. This may result in userspace attempting to submits a job before the register map is initialized. Address this by moving register initialization before host1x client registration.
02KernelScan AI Analysis
Risk summary
A race condition in the Tegra gr2d/gr3d GPU driver allows a local user to submit a job before the address register map is initialized, potentially leading to memory corruption. The issue requires specific Tegra hardware and a narrow timing window.
Vulnerability analysis
The Tegra gr2d and gr3d GPU drivers register a host1x client (making the device available to userspace) before initializing the address register map. A local user can open the device and submit a job in the window between registration and initialization, causing the driver to operate on an uninitialized register map. The fix moves register map initialization before host1x client registration, closing the window. This is reachable by any local user with access to the GPU device node on Tegra systems.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 3.10 | 6.12.97 | 5db37fd7710e |
| 6.18 | 3.10 | 6.18.40 | 40a2a91da02c |
| 6.6 | 3.10 | 6.6.145 | 6e22d5ad61cf |
| 7.1 | 3.10 | 7.1.5 | 3055292b8eed |
| mainline | 3.10 | 7.2 | c4ef5ba11313 |
| cip/6.12 | 3.10 | 6.12.101-cip29 | 5db37fd7710e |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.101-cip29 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |