---
id: CVE-2026-80883
title: >-
  drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is
  registered
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is
  registered


  The host1x_client_register() function is called just prior to register map

  ini…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 <
    3a5f1ac5658bae5200bb6a85312b5388bc26ca55
  - >-
    Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 <
    6e22d5ad61cfa38aa53fab86a530113aff6a3619
  - >-
    Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 <
    5db37fd7710e74bc4df48bddab8f571d0bfc6769
  - >-
    Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 <
    40a2a91da02c434938f0ba53877984820800b5f0
  - >-
    Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 <
    3055292b8eed69553b389a609197a241df47e68e
  - >-
    Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 <
    c4ef5ba1131346159e31f4ef858525cf377380a6
  - Linux 3.10
published: '2026-09-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:31:22.320Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80883'
references:
  - url: 'https://git.kernel.org/stable/c/3a5f1ac5658bae5200bb6a85312b5388bc26ca55'
  - url: 'https://git.kernel.org/stable/c/6e22d5ad61cfa38aa53fab86a530113aff6a3619'
  - url: 'https://git.kernel.org/stable/c/5db37fd7710e74bc4df48bddab8f571d0bfc6769'
  - url: 'https://git.kernel.org/stable/c/40a2a91da02c434938f0ba53877984820800b5f0'
  - url: 'https://git.kernel.org/stable/c/3055292b8eed69553b389a609197a241df47e68e'
  - url: 'https://git.kernel.org/stable/c/c4ef5ba1131346159e31f4ef858525cf377380a6'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.0534
ingestedAt: '2026-11-05T15:02:32.627Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered

The host1x_client_register() function is called just prior to register map
initialization loop, making the device available to userspace. This may
result in userspace attempting to submits a job before the register map is
initialized. Address this by moving register initialization before host1x
client registration.

## Affected

- `Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 < 3a5f1ac5658bae5200bb6a85312b5388bc26ca55`
- `Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 < 6e22d5ad61cfa38aa53fab86a530113aff6a3619`
- `Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 < 5db37fd7710e74bc4df48bddab8f571d0bfc6769`
- `Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 < 40a2a91da02c434938f0ba53877984820800b5f0`
- `Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 < 3055292b8eed69553b389a609197a241df47e68e`
- `Linux >= d43f81cbaf43531a977e8b4c4427f19acf8a5061 < c4ef5ba1131346159e31f4ef858525cf377380a6`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.