NVIDIA GPU Driver CVE-2026-47566

Requires an existing unprivileged local account (PR:L) on a Linux system running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) - this is a local-only vulnerability (AV:L), not remotely reachable, and needs no user interaction. Exploitation depends on repeatedly driving the kernel-mode driver's error paths so that the CWE-401 leak accumulates until kernel memory is exhausted; a single invocation is insufficient. Limiting factors: no network vector, low but non-zero privilege prerequisite, availability-only impact (no code execution or data access), and the need for sustained repeated triggering to reach memory exhaustion. Highest real-world relevance is on shared/multi-tenant Linux GPU hosts (vGPU, VDI, cloud GPU) where one tenant's DoS affects others.

This is a genuinely low-to-moderate priority issue despite being kernel-mode. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the CWE-401 memory-leak description: impact is availability-only (A:H) with no confidentiality or integrity loss, and exploitation requires local access with existing low privileges. No EPSS score, no CISA KEV listing, and no public POC were provided, so all signals point to a theoretical, non-weaponized DoS rather than an actively exploited flaw. Under an SSVC lens this scores low: exploitation is not observed, automatability is limited (an attacker must already have a local account and repeatedly drive error paths to exhaust kernel memory over time), and technical impact is partial (availability only, no code execution or data exposure). There is no conflict between the CVSS vector and the description - both agree on local, low-privilege, DoS-only. The main caveat is that A:H reflects a full host/GPU-service crash from kernel memory exhaustion, which in shared multi-tenant GPU environments (VDI, cloud GPU, vGPU hosts) could affect other tenants; in single-user workstations the impact is limited to self-inflicted denial of service.

An attacker with an unprivileged local account on a Linux host running the affected NVIDIA GPU driver repeatedly invokes a driver interface in a way that triggers the error path failing to free kernel memory. Over many iterations the leaked allocations exhaust kernel memory, crashing the GPU driver or the host and denying service to legitimate users. No public exploit code has been identified at time of analysis, and the attack yields only denial of service - no code execution or data disclosure.