NVIDIA Display Driver EUVD-2026-90090

Requires local access to a system running the NVIDIA GPU Display Driver for Linux (kernel-mode component) - either a low-privileged shell on the host or untrusted code inside a guest using the NVIDIA vGPU guest driver on a shared GPU manager host. The attacker must reach the driver's event-buffer-setup path and supply mismatched/undersized memory buffers to trigger the out-of-bounds write. Limiting factors: no network vector (AV:L), the attacker must already be able to run code locally with at least low privileges (PR:L), and the affected code is the kernel-mode layer of the NVIDIA Linux driver specifically - Windows and systems without the NVIDIA driver are unaffected. No user interaction is required (UI:N).

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local-only privilege-escalation-class kernel memory-corruption bug: an already-authenticated low-privileged local user triggers an out-of-bounds write in the NVIDIA kernel-mode driver. All three impact metrics are High because a controlled kernel-space OOB write can plausibly be leveraged into ring-0 code execution. However, the local attack vector (AV:L) is the dominant limiting factor - there is no remote or network-facing exposure, so this is not a mass-exploitable or wormable condition. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit is referenced (only NVDA/CVE.org pointers and NVIDIA's product-security advisory directory), so exploitation status is: no public exploit identified at time of analysis. Net assessment: a genuine local privilege-escalation risk warranting prompt patching on multi-user, container, or virtualized-GPU hosts where untrusted local/guest code runs, but NOT an emergency internet-facing crisis. The vGPU/Guest-Driver tags raise the stakes on shared-tenancy hosts (guest-to-host or cross-tenant impact) - but note the CVSS scope is Unchanged (S:U), which conflicts with a full guest-to-host escape interpretation and should be verified against NVIDIA's advisory 5861.

A low-privileged local user (or untrusted code inside a VM guest using the NVIDIA guest driver on a shared GPU host) opens the NVIDIA GPU device and issues an event-buffer-setup request supplying mismatched/undersized memory buffers, triggering an out-of-bounds write in the kernel-mode layer. By shaping kernel heap layout, the attacker corrupts adjacent kernel structures to escalate from unprivileged user to root/kernel. No public proof-of-concept is referenced, and the local attack vector requires the attacker to already have code execution on the host or guest.