NVIDIA Display Driver EUVD-2026-31925

Local access to the Linux system is required - remote exploitation is not possible per AV:L in the CVSS vector. A low-privileged, authenticated user account (PR:L) is necessary; unauthenticated exploitation is not supported by the available data. Attack complexity is high (AC:H), meaning the race condition window is timing-dependent and not reliably reproducible without a purpose-built exploit that precisely controls thread scheduling and memory access patterns. The vulnerability is Linux-specific and requires an NVIDIA GPU to be present with a vulnerable driver installed. The SSVC Automatable:no rating confirms this cannot be reliably scripted for mass exploitation. Exploitation is further limited to a denial-of-service outcome only - no privilege escalation, code execution, or data exfiltration is indicated by the CVSS confidentiality and integrity scores of N/N.

The CVSS 4.7 Medium score reflects an accurately limited threat profile: AV:L requires physical or shell-level local access, AC:H acknowledges the timing-dependent, non-trivial nature of race condition exploitation, and PR:L confirms a low-privileged but authenticated user account is necessary. The impact is constrained to availability (A:H, C:N, I:N), meaning confidentiality and integrity are not at risk. EPSS corroborates this: 0.01% exploitation probability at the 1st percentile signals near-zero observed or anticipated weaponization in the threat landscape. SSVC reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial. There is no conflict between these signals; they consistently point to a low-priority, non-urgent vulnerability. The highest real-world risk applies to multi-tenant Linux environments such as cloud GPU compute nodes, VDI deployments, or HPC clusters where untrusted low-privileged users share access to NVIDIA GPU hardware, as a malicious tenant could intentionally trigger the race to disrupt co-tenants or the host. For single-user workstations, the risk is negligible.

A low-privileged local user on a Linux system running a vulnerable NVIDIA driver obtains shell access and repeatedly invokes driver interfaces (e.g., via /dev/nvidia* device nodes or IOCTL calls) to race concurrent memory operations within the kernel module, exploiting the window created by reordered instructions. No public proof-of-concept code has been identified at time of analysis, and the high attack complexity (AC:H) means successful triggering requires precise timing, likely through a crafted program that induces the race under specific scheduler conditions. The ultimate impact is a kernel-level availability failure such as a NULL pointer dereference, BUG_ON assertion, or system hang.