Linux Kernel EUVD-2026-35433

Three prerequisites must simultaneously hold: (1) the target system has a PCI-connected NVIDIA GPU present and recognized by the kernel; (2) the open-source nouveau kernel module is loaded - systems using the proprietary nvidia.ko driver are entirely unaffected; and (3) aperture_remove_conflicting_pci_devices() returns a failure during the driver probe sequence, which occurs when aperture conflicts with another driver or firmware framebuffer cannot be resolved. CVSS PR:L confirms low-privilege local authentication is sufficient once the system is accessed; no network exposure exists (AV:L). What limits exploitation: the aperture failure condition is not reliably triggerable by an unprivileged user under normal hardware and driver configurations, making consistent exploitation difficult. No user interaction by a third party is required (UI:N) once the attacker has local shell access.

The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects a local, low-complexity flaw requiring only low privileges, with availability as the sole impact dimension - confidentiality and integrity are unaffected, making the 'Information Disclosure' tag in the intelligence data appear to be a tagging error inconsistent with both the description and the CVSS vector. EPSS at 0.02% (5th percentile) confirms this is not a commonly exploited class of vulnerability. The absence from CISA KEV and lack of any public POC further reduce urgency. The primary real-world constraint is that the vulnerable code path fires only when aperture_remove_conflicting_pci_devices() returns an error during driver probe - a relatively uncommon condition that is difficult to reliably trigger without hardware-level influence. Exploitation additionally requires the nouveau driver to be active, which excludes the large population of NVIDIA GPU users relying on the proprietary driver. Overall, this is a genuine defect warranting patching in routine maintenance cycles but does not represent an urgent, weaponizable threat.

A local user with a standard shell account on a Linux system equipped with an NVIDIA GPU running the nouveau driver repeatedly triggers GPU probe sequences that cause aperture_remove_conflicting_pci_devices() to return an error - for instance by manipulating PCI device state or exploiting hardware initialization races - causing each failed probe attempt to leak an nvkm_device structure and a PCI enable reference. Sustained repetition of this cycle progressively exhausts kernel memory, ultimately triggering an out-of-memory condition and system instability or crash. No public proof-of-concept exists; reliably inducing the aperture failure condition in practice requires privileged hardware access or specific platform conditions.