Skip to main content

NVIDIA Display Driver CVE-2025-33221

| EUVDEUVD-2025-209936 MEDIUM
Improper Input Validation (CWE-20)
2026-05-26 nvidia GHSA-mc8c-mh26-q8q7
Denial Of Service Nvidia Microsoft Linux Geforce Rtx Quadro Nvs Tesla Guest Driver
6.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
CVSS changed
Jun 11, 2026 - 03:07 NVD
4.4 (MEDIUM) 6.0 (MEDIUM)
Analysis Generated
Jun 08, 2026 - 12:36 vuln.today

DescriptionNVD

NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a critical resource. A successful exploit of this vulnerability might lead to data tampering and denial of service.

AnalysisAI

Incorrect permission assignment in the NVIDIA Display Driver kernel module on Windows and Linux allows a highly privileged local user to corrupt critical resource permissions, leading to denial of service and potentially data tampering. Affected product lines span GeForce (limited to Maxwell, Volta, and Pascal architectures on some branches), RTX/Quadro/NVS, Tesla, and Guest (vGPU) drivers across multiple version branches. No public exploit exists and no active exploitation has been identified; SSVC assessment rates exploitation as none and impact as partial, consistent with the moderate CVSS score of 4.4.

Technical ContextAI

The vulnerability resides in the NVIDIA kernel-mode display driver (nvlddmkm.sys on Windows; nvidia.ko on Linux), which manages low-level GPU resource allocation and memory permission enforcement. CWE-20 (Improper Input Validation) is the reported root cause class, meaning the driver fails to sufficiently validate inputs before using them to configure permissions on a critical kernel resource - consistent with improper IOCTL or device-node request handling that can result in CWE-732 (Incorrect Permission Assignment). CPE data confirms affected products as cpe:2.3:a:nvidia:geforce:*, cpe:2.3:a:nvidia:rtx,_quadro,_nvs:*, cpe:2.3:a:nvidia:tesla:*, and cpe:2.3:a:nvidia:guest_driver:*, covering both bare-metal and virtualized (vGPU) deployment contexts across Windows and Linux host and guest environments. The GeForce impact is additionally restricted by architecture: only Maxwell, Volta, and Pascal GPU generations are confirmed affected on specific driver branches.

RemediationAI

The primary fix is to upgrade to the patched driver versions published by NVIDIA. For Windows: GeForce, RTX/Quadro/NVS, and Tesla users should upgrade to 596.36 or later; RTX/Quadro/NVS and Tesla users on the 535.x branch should upgrade to 535.309.01. For Linux: upgrade to 595.71.05, 582.53, 580.159.03, or 539.72 depending on your installed branch. vGPU guest driver users should apply the corresponding fixes: 535.288.01 or 539.64 for vGPU 16.x, 582.16 or 580.126.09 for vGPU 19.x, and 595.97 or 595.58.03 for vGPU 20.x. Full patched version details are available at https://nvidia.custhelp.com/app/answers/detail/a_id/5821. If immediate driver upgrade is not possible, a compensating control is to restrict local administrative access to systems running exposed driver versions - since PR:H is required, tightening privilege assignment (e.g., removing unnecessary local admin accounts, enforcing least-privilege policies) reduces the effective attack surface. Note that this control does not eliminate the vulnerability and is not a substitute for patching.

More in Geforce

View all
CVE-2026-24187 HIGH
8.8 May 26

Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
CVE-2026-24193 HIGH
7.8 May 26

Local privilege escalation in the NVIDIA Display Driver for Windows and Linux allows an authenticated low-privileged use
CVE-2026-24192 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
CVE-2026-24191 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager

CVE-2026-24194 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) a
CVE-2026-24190 HIGH
7.8 May 26

Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows authenticated low-privilege users to im
CVE-2026-24196 HIGH
7.1 May 26

Out-of-bounds read in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU Guest drivers) allows a

CVE-2026-24197 MEDIUM
6.5 May 26

NVIDIA Display Driver for Linux exposes a denial-of-service condition in the Multi-Instance GPU (MIG) partition manageme
CVE-2026-24182 MEDIUM
6.5 May 26

Denial of service in NVIDIA Display Driver for Windows and Linux stems from improper lock management (CWE-667), where an
CVE-2026-24198 MEDIUM
5.6 May 26

Race condition in NVIDIA GPU Display Driver for Linux allows a high-privileged local attacker to leak sensitive kernel o
CVE-2026-24199 MEDIUM
4.7 May 26

Race condition exploitation in NVIDIA Display Driver's Linux kernel module allows a local authenticated user to cause de

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2025-33221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy