Executive brief
The Linux kernel's Tegra graphics driver (gr2d and gr3d) contained an initialization order bug in device probe functions. The device was registered and made available to user applications before critical hardware register maps were initialized, potentially allowing user-space graphics jobs to be submitted to uninitialized hardware. This could cause driver malfunction or system instability when graphics jobs attempt to access unmapped memory regions.
Technical details
The vulnerability is a race condition in the gr2d_probe() and gr3d_probe() functions within drivers/gpu/drm/tegra/. The host1x_client_register() call exposed the device to user-space before the address register map initialization loop completed. An attacker or application could submit graphics jobs via the ioctl interface before the register bitmap (addr_regs) was populated by set_bit() calls, resulting in access to uninitialized hardware state. The fix reorders initialization to populate the address register map before calling host1x_client_register(), eliminating the race window. The vulnerability affects any kernel version with this code path; the patch was backported across stable branches.
Affected products
- Linux Linux kernel Multiple stable versions (2.6 through 7.x)
Timeline
- 2026-09-04: disclosed: Published in NVD
- 2026-05-17: patched: Upstream commit c4ef5ba1131346159e31f4ef858525cf377380a6 authored
- 2026-07-24: patched: Backported to stable kernel branches