NVIDIA GPU Driver EUVD-2026-90087

Requires local access with an unprivileged user account on a Linux system running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla lines); the attacker must be able to interact with the kernel-mode driver interface (device nodes/ioctls), which unprivileged users typically can. No authentication beyond a local login, no user interaction, and no special non-default configuration is required - the flaw is in the standard kernel-mode driver layer. Exploitation is LIMITED to local vectors (AV:L): it cannot be triggered remotely over a network, so an attacker must already have a foothold on the host; highest real-world value is on shared/multi-tenant GPU hosts.

This is a genuine high-priority local privilege-escalation risk, not a high-CVSS-but-low-impact issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) is internally consistent with the description: a local, low-privileged, unprivileged user triggers improper release of memory in the kernel-mode driver, leaving a stale mapping that survives memory reuse - a use-after-free / dangling-mapping class flaw (CWE-404). Because the vulnerable code runs in the kernel-mode layer, successful exploitation yields full C:H/I:H/A:H, which maps to the vendor-listed outcomes of code execution, privilege escalation, DoS, information disclosure, and data tampering. Low attack complexity (AC:L) and no user interaction (UI:N) mean any local unprivileged account can attempt it reliably. Countervailing signals: no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation or a published PoC at analysis time. The local-only attack vector (AV:L) is the main risk-limiter - this is not remotely exploitable and requires a foothold on the host. On multi-tenant or shared GPU systems (ML clusters, VDI, shared workstations) this becomes a meaningful escape/escalation primitive; on single-user desktops the practical risk is lower.

A local unprivileged user on a Linux host running the affected NVIDIA GPU driver issues crafted calls (e.g., ioctls) to the kernel-mode driver that cause memory resources backing a mapping to be freed improperly while the user-space mapping remains valid. After the underlying memory is reallocated for other kernel data, the attacker reads or writes through the stale mapping to corrupt kernel state, achieving privilege escalation or kernel code execution. No public exploit code was identified at time of analysis, and low attack complexity with no user interaction makes exploitation straightforward once local access is obtained.