NVIDIA GPU Driver CVE-2026-47588

Requires an authenticated, unprivileged local user with the ability to open the NVIDIA GPU driver device interface and issue ioctls on a Linux host running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, Tesla; the 'Guest Driver' tag indicates vGPU/guest-VM deployments are also in scope). Exploitation is limited by the local-only attack vector (no remote or network path), the need for a precise ordered driver-command sequence to win the use-after-free, and - for reliable code execution rather than mere DoS - kernel heap grooming against standard kernel mitigations. Highest realistic exposure is on shared or multi-tenant systems (VDI, container hosts, cloud/vGPU instances) where untrusted users hold local accounts.

This is a genuine but locally-scoped privilege-escalation risk, not a remote-drive-by. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: an already-authenticated, unprivileged local user triggers a use-after-free (CWE-416) via a crafted sequence of driver commands (ioctls) to the kernel-mode GPU driver. All three impacts are High because a kernel UAF can plausibly yield ring-0 code execution, and the 'RCE' tag is therefore misleading - the attack vector is local (AV:L), so any code execution requires the attacker to already have a foothold on the host. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. Reliability of UAF-to-code-execution exploitation depends on kernel heap grooming and mitigations (KASLR, SMEP/SMAP), which typically raises real-world exploit complexity above the vendor's AC:L rating; DoS (driver/GPU crash) is the most readily achievable outcome. Net: a solid patch-management priority on multi-user, shared-GPU, and VDI/cloud-GPU Linux hosts, but lower urgency on single-user workstations where a local low-priv attacker is already present.

A logged-in unprivileged user (or a low-privileged process/container tenant) on a Linux host with NVIDIA GPU drivers issues a specific ordered sequence of driver ioctls that frees a kernel object and then references the dangling pointer, corrupting kernel memory. By grooming the kernel heap to reclaim the freed allocation with attacker-controlled data, the user escalates to root or crashes the driver. No public exploit code is identified at this time; exploitation requires local access and no user interaction.