CVE-2026-80883: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-80883 is a use-before-initialization vulnerability in the Linux kernel's drm/tegra graphics driver (gr2d/gr3d subsystem). The flaw arises because host1x_client_register() is called before the address register map initialization loop completes, making the Tegra graphics device available to userspace prematurely. It affects Linux kernel versions across multiple stable branches: before 6.6.145, before 6.12.97, before 6.18.40, and before 7.1.5. The vulnerability was published on September 4, 2026, with patches available the same day. The CVSS base score is listed as 0.0 (no official severity rating assigned at time of publication), though Feedly estimates it as Medium severity (GitHub Advisory, Feedly).

The root cause is a race condition / use-before-initialization (CWE-908) in the drm/tegra driver's initialization sequence. Specifically, host1x_client_register() exposes the device to userspace before the address register map has been fully populated in the subsequent initialization loop. A local user with access to the Tegra graphics device node can submit a job via the HOST1X interface during this narrow initialization window, causing the kernel driver to operate on an uninitialized register map. The fix reorders initialization so that the register map is fully set up before host1x_client_register() is called, eliminating the race (GitHub Advisory, Kernel Patch).

Successful exploitation could lead to memory corruption or kernel-level code execution within the context of the Tegra graphics driver, as uninitialized memory is accessed during job processing. The impact is limited to systems running Linux on NVIDIA Tegra hardware (e.g., embedded systems, Jetson platforms) where a local user has access to the graphics device. Confidentiality, integrity, and availability of the kernel graphics subsystem are all potentially affected, though lateral movement beyond the local system is unlikely given the local-only attack vector (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The attack requires local access to a Tegra graphics device, significantly limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.6.145 or later (6.6.x branch), 6.12.97 or later (6.12.x branch), 6.18.40 or later (6.18.x branch), 7.1.5 or later (7.1.x branch), or 7.2 and above. The fix is available via multiple stable-tree commits (e.g., 6e22d5ad61cf, 5db37fd7710e, 40a2a91da02c, 3055292b8eed, c4ef5ba11313). No configuration-based workaround is documented; upgrading to a patched kernel is the recommended remediation (GitHub Advisory, Kernel Patch).