EUVD-2026-90069
GHSA-cm2q-4wpr-26jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain high-priv local access on hypervisor host
-
DeliverySend crafted request to vGPU Manager kernel layer
-
ExploitTrigger out-of-bounds read in kernel mode
-
ExecutionLeak or corrupt kernel memory
-
ImpactEscalate privileges / crash host / disclose tenant data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local, HIGH-privilege access to a Linux host running the NVIDIA vGPU Virtual GPU Manager (the hypervisor/host component of a vGPU deployment) - per PR:H the attacker must already be a privileged user on that host, not an ordinary guest VM tenant or unprivileged local user. Exploitation targets the kernel-mode layer of the vGPU Manager; no user interaction is required (UI:N) and no non-default feature toggle is described, but the flaw is only reachable in vGPU/VDI/cloud-GPU deployments that run the Virtual GPU Manager. The PR:H requirement and local-only vector (AV:L) are the primary limiters that keep real-world risk moderate despite the high impact triple. |
| Impact | This is a moderate-priority, defense-in-depth issue rather than an urgent one. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U) confirms local-only exploitation requiring HIGH privileges - the vendor 6.7 score is honest, and I agree with it. PR:H is the key limiter and is notable: most sibling CVEs in NVIDIA bulletin 5861 are PR:L, but the Virtual GPU Manager runs on the hypervisor host, so an attacker already needs privileged access to that host layer. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' The high C:H/I:H/A:H impact triple reflects the theoretical worst case of a kernel-mode memory-safety flaw, but it is gated behind both local access and high privilege. The 'RCE' tag conflicts with the AV:L vector - this is local privilege escalation / kernel compromise, not remote code execution; verify against the local vector before treating it as network-exploitable. Overall a real bug worth patching in vGPU/VDI/cloud-GPU fleets, but not a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker who already holds high-privilege access on a Linux hypervisor host running the NVIDIA vGPU Virtual GPU Manager issues crafted requests to the kernel-mode layer that trigger an out-of-bounds read. The leaked or corrupted kernel memory is then leveraged to escalate further, crash the host (DoS affecting all hosted vGPU tenants), or disclose data across the virtualization boundary. No public exploit code is known, and the required high privilege plus local access make opportunistic exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds read in the kernel-mode layer of NVIDIA's vGPU Virtual GPU Manager for Linux allows a local, already highly privileged user on the hypervisor host to drive the driver past the bounds of an allocated buffer, with the potential for kernel code execution, privilege escalation, information disclosure, denial of service, or data tampering. The issue is rated CVSS 3.1 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and is confined to Linux hosts running the Virtual GPU Manager in vGPU/VDI or cloud-GPU deployments; no public exploit has been identified at time of analysis. Because the attacker must already be authenticated with high privileges on the host and the attack surface is local-only, this is a moderate-priority, defense-in-depth issue rather than an urgent remote threat.
RemediationAI
Patch status is per vendor advisory: NVIDIA has published a security bulletin for this issue (referenced via https://github.com/NVIDIA/product-security/tree/main/2026/5861, alongside the NVD and CVE.org records), but the provided data does not specify an exact fixed version, so administrators should consult that bulletin and install the corrected Virtual GPU Manager for Linux release for their branch before exposing the driver to further use. Because exploitation requires high privileges on the host (PR:H) and local access (AV:L), the most effective compensating controls are administrative rather than network-facing: strictly limit and audit who holds root/hypervisor administrator rights on vGPU hosts, since any principal with that access is already inside the trust boundary the fix is meant to enforce; avoid running untrusted or third-party kernel-mode code on the same host; and monitor kernel logs and driver telemetry for anomalous fault or crash patterns that could indicate exploitation attempts. There is no documented non-default feature that can simply be disabled to eliminate the flaw, so where the patched driver cannot be deployed immediately, isolating vGPU hosts to tightly controlled administrative groups and reducing the number of privileged operators is the practical interim mitigation, accepting that it does not remove the underlying out-of-bounds read.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the NVIDIA vGPU Virtual GPU Manager for Linux, the host-side (hypervisor kernel-mode) driver that brokers GPU resources for guest VMs in vGPU deployments. The root cause class is CWE-125 (Out-of-bounds Read): the kernel mode layer reads memory beyond the end of a buffer without validating index or length, a defect that can expose adjacent kernel memory (information disclosure) and, depending on the surrounding code and allocator state, may be chained into memory corruption leading to code execution or privilege escalation in kernel context. The reported impacts span the full C/I/A triple with Scope Unchanged, and the CPE data (cpe:2.3:a:nvidia:virtual_gpu_manager:* with version wildcards across four entries) indicates multiple product branches/versions are affected without the specific ranges being enumerated in the provided intelligence, so the NVIDIA advisory should be consulted for exact branch mapping. Exploitation requires AV:L combined with PR:H - the attacker must already be a privileged local user on the host - and UI:N means no victim interaction is needed, though there is no indication that an ordinary unprivileged guest VM tenant can reach the flaw.
Know when Virtual Gpu Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local kernel-mode flaw on the hypervisor host requiring high privilege (PR:H) and no user interaction; full CIA impact from potential kernel compromise, scope unchanged - matches vendor 6.7.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
3DescriptionCVE.org
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Virtual Gpu Manager
View allLocal privilege escalation and code execution in the NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, an
An out-of-bounds read in the kernel-mode layer of NVIDIA GPU Display Driver on Windows and Linux allows a local, authent
Local privilege escalation and potential code execution in NVIDIA GPU Display Driver for Windows and Linux arise from a
Local privilege escalation in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux allows an unprivileged lo
Privilege escalation in NVIDIA's GPU Display Driver for Windows lets a local, low-privileged authenticated user bypass a
Local privilege escalation in NVIDIA Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager b
Local privilege escalation in NVIDIA Display Driver for Windows (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest/manager
Incorrect resource transfer between spheres in the NVIDIA vGPU Virtual GPU Manager for Linux allows a locally positioned
An out-of-bounds write in the kernel-mode layer of NVIDIA vGPU Virtual GPU Manager for Linux lets a local attacker with
Local privilege escalation, code execution, denial of service, and information disclosure affect Linux hosts running NVI
Local privilege escalation in NVIDIA vGPU Virtual GPU Manager for Linux stems from an out-of-bounds read in firmware (CW
Local attackers with low privileges on a Linux host running NVIDIA vGPU Virtual GPU Manager can trigger an out-of-bounds
Exploit-DB