EUVD-2026-90165
GHSA-chrp-xcqg-4729
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged local account
-
DeliveryIssue concurrent kernel-mode driver calls
-
ExploitWin race condition window
-
ExecutionTrigger out-of-bounds write
-
PersistCorrupt kernel memory
-
ImpactExecute code / escalate in kernel context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an already-privileged local user (PR:H) on a Linux system running the affected NVIDIA GPU Display Driver kernel-mode layer (GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver branches). Exploitation is gated by a race condition (AC:H): the attacker must reliably win a narrow timing window between concurrent kernel operations to trigger the out-of-bounds write, which is non-deterministic and typically needs many attempts. No user interaction is required (UI:N), and no network access is involved - the vector is entirely local. These high-privilege and high-complexity prerequisites substantially limit realistic exploitation versus the lower-barrier siblings in the same bulletin. |
| Impact | All signals point to a genuine but modest-priority local vulnerability. The vendor CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.4) is internally consistent with the description: exploitation requires a *privileged* local user (PR:H) to win a *race condition* (AC:H), which is why the score lands well below the 7.8 of the PR:L/AC:L siblings in the same NVIDIA bulletin 5861 batch. I agree with the 6.4 assessment. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The high PR and high AC requirements make this a low-likelihood, targeted issue rather than a mass-exploitation candidate; the 'RCE' tag overstates real risk because the vector is strictly local (AV:L), not network-borne. The full C:H/I:H/A:H impact is meaningful once the narrow race is won, but the privileged-user precondition means an attacker must already hold significant access. This is a real-but-secondary patch priority, not an emergency. |
| Exploit ScenarioDerived | A local attacker who already holds a privileged account on a Linux host with the NVIDIA GPU Display Driver repeatedly issues concurrent kernel-mode ioctl/driver operations to win a timing race, triggering an out-of-bounds write in the kernel module. By grooming kernel memory around the race window they corrupt adjacent structures to execute code in kernel context or crash the system. No public exploit code was identified, and the high attack complexity (race condition) makes reliable exploitation difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux can be triggered by an already-privileged local user who wins a narrow race condition between concurrent kernel operations, potentially yielding code execution in kernel context, denial of service, privilege escalation, information disclosure, and data tampering. Affected branches include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver products on Linux (CVSS 3.1 base 6.4). Impact is bounded by the requirement for high local privileges (PR:H) and the non-deterministic nature of the race (AC:H); no public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
NVIDIA has published a security bulletin for this issue at https://github.com/NVIDIA/product-security/tree/main/2026/5861; the exact fixed driver version is not confirmed in the provided data, so administrators should consult that advisory and upgrade each affected branch (GeForce, RTX/Quadro/NVS, Tesla, Guest Driver) to the driver release NVIDIA lists as patched for CVE-2026-47565, then reboot or unload/reload the kernel module so the corrected code is loaded. Because exploitation requires an already-privileged local account (PR:H), the strongest compensating control is least-privilege enforcement: restrict and audit privileged local accounts, sudoers entries, and any process able to open /dev/nvidia* device nodes, and remove unnecessary local admin rights - the trade-off is reduced operational convenience for legitimate GPU administration. Where the driver cannot be updated immediately, avoid running untrusted or concurrent GPU workloads under privileged accounts, and monitor kernel logs for GPU/driver faults that could indicate repeated race attempts; note that unlike network-facing mitigations there is no firewalling or port-blocking option here, since the vector is entirely local. Kernel-module signing and lockdown modes do not prevent this class of bug in an already-privileged caller and should not be relied upon as a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the kernel-mode layer of NVIDIA's Linux display driver - the privileged component that mediates GPU hardware access from user space. It is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e., a race condition): two concurrent kernel operations can interleave such that a buffer boundary check or length calculation is performed against stale state, and the subsequent write lands outside the intended allocation, producing an out-of-bounds write. Because the write occurs in kernel memory, successful corruption can pivot to arbitrary code execution at ring 0, crash the system, leak kernel memory, or silently alter driver/GPU data. CPE evidence confirms the defect spans multiple driver product trees - nvidia:geforce, the combined nvidia:rtx,_quadro,_nvs family, nvidia:tesla, and the Guest Driver branch (per tags) - indicating the same kernel-mode code path is shared across consumer, professional, and datacenter driver packages on Linux.
Know when Geforce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Local kernel driver (AV:L), race condition win required (AC:H), description explicitly names a privileged user (PR:H); OOB write yields full C:H/I:H/A:H within the unchanged kernel scope.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trigger a race condition that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
An out-of-bounds write in NVIDIA NVAPI for Windows allows a locally authenticated attacker holding standard user privile
Type confusion in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows a local low-privileged user (C
Local privilege escalation in NVIDIA GPU Display Driver for Windows (CUDA driver component) allows an authenticated atta
Local privilege escalation in NVIDIA Display Driver for Windows allows an authenticated low-privileged user to trigger a
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in NVIDIA Display Driver for Windows and Linux allows an unprivileged local attacker to trigg
Local privilege escalation and memory corruption in NVIDIA GPU Display Driver on Windows and Linux, affecting GeForce, R
Local privilege escalation in the NVIDIA GPU Display Driver for Linux allows an authenticated, unprivileged user to trig
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Exploit-DB