EUVD-2026-90068
GHSA-x55q-3r5q-v2w2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-priv access on vGPU host
-
DeliverySend crafted request to kernel-mode layer
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt kernel memory state
-
ImpactExecute code / escalate to kernel privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to the Linux host running NVIDIA vGPU Virtual GPU Manager with at least low privileges (PR:L) - e.g. an authenticated local user or a tenant/guest context able to reach the kernel-mode layer. No user interaction is needed (UI:N) and no special non-default configuration is called out beyond having the vGPU Manager kernel module in use. Limiting factors: the attack vector is LOCAL (AV:L) not network, so remote unauthenticated exploitation is not possible; the flaw is Linux-specific and confined to the vGPU Manager host component, which chiefly matters in multi-tenant VDI/cloud-GPU environments where the local-access barrier is meaningfully lower. |
| Impact | CVSS 3.1 base score 7.8 (HIGH) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - this is a LOCAL, low-privilege attack, NOT remote despite the 'RCE' tag. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so all three exploitation-probability signals are absent/unknown. SSVC data is not provided. The severity is driven entirely by high technical impact (C:H/I:H/A:H via kernel-mode OOB write), not by ease or likelihood of remote exploitation: an attacker must already have local, authenticated access with some privileges on the hypervisor host running the Virtual GPU Manager. This makes it a genuine privilege-escalation / host-integrity concern in multi-tenant vGPU/VDI/cloud-GPU deployments (guest-to-host or cross-tenant boundary) but not a mass-exploitable internet-facing flaw. Net: a real 'patch on normal cycle, prioritize in multi-tenant GPU hosts' issue rather than an emergency. Note the 'RCE' tag is misleading given AV:L - code execution is achievable but only locally. |
| Exploit ScenarioDerived | A low-privileged local user or a malicious/compromised guest tenant on a Linux hypervisor host running NVIDIA vGPU Virtual GPU Manager issues crafted requests to the kernel-mode layer that trigger an out-of-bounds write. By controlling the overwritten kernel memory, the attacker corrupts kernel state to escalate privileges or execute code in kernel context, or simply crashes the host for denial of service. No public exploit code is identified at time of analysis, and exploitation requires existing local access (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with low privileges corrupt kernel memory, which the vendor rates as potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering (CVSS 3.1 base 7.8, HIGH). The attack is strictly local - vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - so it is not remotely exploitable and requires only an authenticated low-privileged context or a tenant/guest that can reach the host kernel module; the risk is highest in multi-tenant VDI and cloud-GPU deployments where local access is comparatively easy to obtain. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so there is no evidence of confirmed active exploitation.
RemediationAI
No vendor-released patch version is identified in the provided data, so the starting point is the NVIDIA product security bulletin at https://github.com/NVIDIA/product-security/tree/main/2026/5861, which should be checked for the exact fixed vGPU Manager release and version-specific guidance before scheduling upgrades; treat installing that build as the primary fix and verify the corresponding driver/manager pairing on each host. Until a fixed build is confirmed and deployed, compensating controls must target the local-access prerequisite: restrict host login and sudo rights to trusted operators and remove interactive access for tenants, which reduces the pool of principals who can reach the vulnerable kernel path; isolate multi-tenant workloads so guest VMs cannot reach host vGPU management interfaces or device nodes beyond what is strictly required, accepting that this may break legitimate GPU passthrough or management workflows; and apply kernel-level hardening such as SELinux/AppArmor confinement and module-loading restrictions (for example, refusing to load the vGPU kernel module on hosts where GPU virtualization is not actively used), with the trade-off that hosts then lose vGPU functionality. Because exploitation requires local privileges and no public exploit code has been identified, prioritize the patch on multi-tenant VDI and cloud-GPU hosts, monitor for unexpected kernel crashes or memory-corruption symptoms in the meantime, and avoid relying on generic network-perimeter defenses since the attack vector is local.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the NVIDIA vGPU Virtual GPU Manager, the host-side driver stack that mediates GPU access for virtual machines on Linux hypervisors; the flaw sits specifically in its kernel-mode layer, meaning it executes with host kernel privileges. The root cause is classified as CWE-787 (Out-of-bounds Write): a bounds check on an attacker-influenced value is missing or incorrect, so a write can land outside the intended buffer or structure, producing memory corruption in kernel space. Because the bug is reachable only through local interfaces on the host, exploitation requires a foothold on the Linux host - an authenticated local user, a privileged container that can reach device nodes, or a guest/tenant context with access to the vGPU manager interfaces. The CPE data (cpe:2.3:a:nvidia:virtual_gpu_manager) is version-agnostic with wildcards on all version fields, so the affected version ranges are not enumerated in the provided intelligence and must be read from the vendor bulletin. The "RCE" tag should be read narrowly: successful corruption can yield code execution in the host kernel context, not unauthenticated remote code execution.
Know when Virtual Gpu Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged access to the vGPU host triggers a kernel OOB write with no user interaction, yielding full C/I/A impact within the same host scope; matches vendor 7.8.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Articles & Coverage 2
Executive ViewAI
NVIDIA's vGPU Virtual GPU Manager for Linux contains a high-severity kernel memory corruption flaw (CVE-2026-47541) that a local low-privileged user can trigger to gain kernel-level control of the host. The risk is concentrated in multi-tenant virtual desktop and cloud-GPU estates, where guest tenants share the host kernel module, so a single compromised or malicious tenant could pivot to the host and affect other customers' data and workloads. Because no vendor patch is available yet, leadership should treat this as a managed exposure requiring tightened tenant isolation and compensating controls until NVIDIA ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict least privilege and remove unnecessary local accounts on vGPU hosts; limit or disable shared/multi-tenant vGPU attachment and isolate high-value tenants onto dedicated hosts; monitor the NVIDIA kernel module for anomalous memory access and privilege escalation; restrict guest-to-host administrative channels; and maintain heightened logging and alerting on affected hosts until the vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Virtual Gpu Manager
View allLocal privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVI
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CW
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds
Out-of-bounds read in NVIDIA vGPU Virtual GPU Manager for Linux allows a local authenticated attacker with low privilege
Exploit-DB