NVIDIA Display Driver CVE-2026-47601

Exploitation requires the host to be running NVIDIA's open-source GPU kernel module (the closed-source path is not implicated) and requires the attacker to already hold a local, low-privileged authenticated account on the affected Windows or Linux system (PR:L, AV:L, UI:N). The specific trigger is importing a read-only buffer through the DMA-BUF import path from another device's DMA-BUF exporter - so a multi-device/GPU-sharing scenario capable of exporting such a buffer must be reachable by the attacker. Limiting factors: no remote or network exploitation is possible, no privilege beyond a normal local user is needed but a foothold is mandatory, and only the open-source kernel module configuration is affected, which constrains the exposed population relative to the full driver install base.

This is a genuine but not emergency-level priority - a classic local privilege-escalation class flaw rather than a remotely exploitable one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) confirms the attacker must already have local, authenticated low-privilege code execution on the host; there is no network reach and no user interaction, but the high triple impact reflects that a successful exploit can fully compromise the kernel. No EPSS score, CISA KEV entry, POC, or SSVC decision data is provided, so exploitation status is: no public exploit identified at time of analysis. The 'RCE' and 'Buffer Overflow' tags overstate the profile - with AV:L this is local code execution/privesc, not remote code execution, and the described mechanism is improper preservation of read-only memory permissions during DMA-BUF import rather than a classic linear buffer overflow, even though NVD assigns CWE-787 (out-of-bounds write). The realistic driver of risk is exposure of the affected open-source kernel module on multi-tenant or GPU-accelerated hosts (VDI, cloud GPU, shared workstations), where a low-privileged user escalating to kernel is high-value. Absent EPSS/KEV, treat this as vendor-reported and patch-driven rather than actively targeted.

A low-privileged local user on a Linux or Windows host running NVIDIA's open-source GPU kernel module imports a read-only DMA-BUF exported by another device; because the read-only access permissions are not correctly preserved on import, the user obtains writable access to memory that should be read-only. By writing to that memory they corrupt kernel state to escalate privileges or execute code in kernel context. No public exploit code is identified at time of analysis, and the local-only, authenticated vector (AV:L/PR:L) means the attacker must first have a foothold on the machine.