NVIDIA GPU Driver CVE-2026-47549

Requires an already-authenticated, unprivileged local user account on a Linux system running the affected NVIDIA GPU Display Driver / kernel module (AV:L, PR:L, UI:N) - there is no remote or network-triggerable path and no user interaction is needed from a victim. Exploitation is limited to causing a NULL pointer dereference in the kernel module leading to denial of service only; it does not yield code execution, privilege escalation, or information disclosure. Practical impact is highest on shared/multi-tenant Linux GPU hosts where a single low-priv user can crash the driver for all workloads; a single-user desktop only crashes the attacker's own machine.

This is a genuinely low-priority issue despite its HIGH-context product footprint. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 MEDIUM) is internally consistent with the description: a NULL pointer dereference in the Linux GPU kernel module reachable only by a local, already-authenticated low-privileged user, with impact confined entirely to availability (C:N/I:N/A:H) - i.e. a host/GPU crash or driver hang, not code execution or data exposure. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation. SSVC-style reading: exploitation=none observed, automatable=no (local-only precondition), technical impact=partial (DoS-only). No signals conflict here - the vector, CWE-476, and DoS-only tagging all agree. The main thing that keeps this from being trivial is the broad deployment of NVIDIA drivers, but a local low-priv attacker crashing a machine they already have an account on is a limited threat.

A local unprivileged user on a Linux workstation or shared GPU/compute host (e.g. a multi-tenant ML server) issues a crafted ioctl or command sequence to the NVIDIA kernel module that triggers a NULL pointer dereference, crashing the driver or the host. No public exploit code is identified at time of analysis, and the attacker must already possess a valid low-privilege local account (AV:L/PR:L), so this is a local availability nuisance rather than a remote or privilege-gaining threat.