CVE-2026-80883: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80883 Overview

CVE-2026-80883 is a race condition in the Linux kernel's Tegra Direct Rendering Manager (DRM) driver, specifically affecting the gr2d and gr3d graphics engines. The flaw stems from calling host1x_client_register() before the address register map is initialized. This ordering exposes the device to userspace prematurely, allowing job submissions against an uninitialized register map. The upstream fix reorders initialization so the register map is populated before the HOST1X client becomes visible to userspace.

Critical Impact
Userspace processes can submit graphics jobs against an uninitialized address register map, producing undefined kernel behavior on affected NVIDIA Tegra platforms running vulnerable Linux kernels.

Affected Products

Linux kernel drm/tegra driver — gr2d engine
Linux kernel drm/tegra driver — gr3d engine
NVIDIA Tegra System-on-Chip platforms using the HOST1X subsystem

Discovery Timeline

2026-09-04 - CVE-2026-80883 published to NVD
2026-09-07 - Last updated in NVD database

Technical Details for CVE-2026-80883

Vulnerability Analysis

The vulnerability resides in the initialization sequence of the Tegra gr2d and gr3d DRM drivers. During device probe, the driver calls host1x_client_register() before executing the register map initialization loop. Once host1x_client_register() returns, the device node is exposed to userspace, which can immediately open the device and submit HOST1X command buffers. If a submission arrives before the address register map is populated, the kernel processes jobs against an incomplete data structure. This is a classic Time-of-Check Time-of-Use (TOCTOU) style ordering defect [CWE-362] where a resource is published to consumers before it is fully initialized.

Root Cause

The root cause is an incorrect initialization order in the driver probe path. Registration with the HOST1X subsystem, which makes the graphics client discoverable and usable, occurs prior to the loop that populates the address register map. The register map is the data structure used to validate and translate addresses in userspace-submitted command streams, so its absence during job processing constitutes an inconsistent driver state.

Attack Vector

Exploitation requires a local unprivileged process capable of opening the Tegra DRM device node and issuing an ioctl submission during the narrow window between HOST1X client registration and completion of register map initialization. A local attacker who successfully races the probe path can trigger undefined kernel behavior during command stream processing. Remote exploitation is not applicable because the attack requires access to the local DRM device.

No verified public proof-of-concept code is available. Refer to the upstream kernel commits listed in the references for the exact code changes: Kernel Fix Commit 3055292, Kernel Fix Commit 40a2a91, Kernel Fix Commit 5db37fd, Kernel Fix Commit 6e22d5a, and Kernel Fix Commit c4ef5ba.

Detection Methods for CVE-2026-80883

Indicators of Compromise

Kernel warnings, oopses, or null-pointer traces originating from drm/tegragr2d or gr3d code paths during early boot or driver reload.
Unexpected process crashes or GPU submission failures on NVIDIA Tegra devices immediately after DRM device node creation.
dmesg entries referencing host1x_client_register correlated with failed userspace job submissions.

Detection Strategies

Inventory Linux systems running on NVIDIA Tegra hardware and identify kernels that predate the upstream fix commits.
Monitor kernel logs on Tegra devices for driver initialization anomalies immediately following module load or system boot.
Audit unprivileged processes accessing /dev/dri/* device nodes on Tegra platforms during startup.

Monitoring Recommendations

Forward kernel logs from Tegra endpoints to a centralized log platform and alert on drm/tegra fault signatures.
Track kernel package versions against the fixed stable releases referenced in the upstream commits.
Correlate DRM device access with process lineage to identify unexpected consumers of the Tegra graphics stack.

How to Mitigate CVE-2026-80883

Immediate Actions Required

Update the Linux kernel on affected Tegra devices to a stable release that includes the upstream fix commits.
Restrict access to /dev/dri/* device nodes to trusted users and processes via standard Linux permissions and udev rules.
Rebuild custom kernels used in embedded Tegra deployments with the patch backported prior to redeployment.

Patch Information

The fix moves address register map initialization to run before host1x_client_register() in both the gr2d and gr3d drivers. The corrected ordering ensures the register map is fully populated before the device becomes visible to userspace. Apply one of the upstream stable kernel updates containing commits 3055292, 40a2a91, 5db37fd, 6e22d5a, or c4ef5ba, matched to your kernel branch.

Workarounds

Where kernel updates cannot be applied immediately, blacklist the tegra-drm module on systems that do not require Tegra graphics acceleration.
Limit local shell and console access on affected embedded devices to reduce the pool of accounts able to race the driver probe path.
Enforce strict udev permissions so only privileged service accounts can open Tegra DRM device nodes.

bash

# Verify running kernel version and Tegra DRM module status
uname -r
lsmod | grep -E 'tegra|host1x'

# Restrict DRM device access via udev (example rule)
# /etc/udev/rules.d/99-tegra-drm.rules
# SUBSYSTEM=="drm", KERNEL=="card*", GROUP="video", MODE="0660"