NVIDIA Display Driver CVE-2025-23300

Exploitation requires a local, authenticated low-privileged user (PR:L) on a Linux system running the affected NVIDIA display/kernel GPU driver; there is no remote vector and no network exposure. The attacker must be able to allocate a specific kernel memory resource through the driver interface (e.g., the GPU device nodes). Limiting factors: no remote access is possible, the attacker must already have local code-execution or shell access, and impact is confined to availability (a crash) with no privilege escalation or data exposure. Systems without the NVIDIA GPU driver loaded are unaffected.

This is a genuinely low-priority issue despite its MEDIUM rating. All signals align downward: the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a local, low-privileged attack whose only consequence is availability loss (A:H) with no confidentiality or integrity impact, capping the score at 5.5. EPSS reinforces this with a 0.15% exploitation probability (4th percentile), and the flaw is NOT listed in CISA KEV, so there is no public exploit identified at time of analysis. No SSVC decision data was provided in the input. The signals are consistent rather than conflicting - a local user who already has a foothold can crash the kernel driver, but cannot escalate privileges, read data, or exploit remotely. The practical worst case is a local denial of service (driver/system crash). Note that because CWE-476 null-pointer dereferences can occasionally be intermediate primitives, the A-only impact should be treated as vendor-assessed rather than independently verified.

A local user with an active session on a Linux host running the NVIDIA display driver allocates a specific GPU/kernel memory resource crafted to trigger a null pointer dereference in the kernel driver. The dereference crashes the driver or kernel, producing a denial of service for the host. No public exploit code has been identified, and the attack requires an existing local low-privileged account.