NVIDIA Display Driver EUVD-2026-90110

Requires an attacker to already possess local, low-privileged access to a host running the vulnerable NVIDIA GPU Display Driver for Linux - in virtualized deployments this maps to an unprivileged user inside a guest using the NVIDIA guest driver / Virtual GPU Manager. No remote network path and no user interaction are involved (AV:L, UI:N). Exploitation is limited to systems with the affected GeForce, RTX/Quadro/NVS, or Tesla driver installed; the primary limiting factor is the need for pre-existing local/guest foothold, which makes this an escalation primitive rather than an initial-access vector.

This is a genuine local privilege-escalation priority rather than a paper tiger, but its ceiling is bounded by the local attack vector. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the CWE-862 (Missing Authorization) description: a user who already has low-privileged access to the host can bypass an authorization check in the kernel-mode layer to modify privileged configuration, yielding full C/I/A impact - the described consequences (code execution, DoS, privilege escalation, information disclosure, data tampering) match the HIGH-across-the-board impact metrics. Low attack complexity (AC:L) and no user interaction (UI:N) mean exploitation is reliable once local access exists, but AV:L means there is no remote exposure - an attacker must first land on the machine. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation likelihood signals are absent; this is a vendor-self-reported (NVIDIA) advisory-driven disclosure, not evidence of in-the-wild abuse. The 'Guest Driver' and 'Virtual Gpu Manager' tags plus the Tesla/RTX-Quadro CPEs indicate vGPU / virtualized deployments are in scope, which raises the stakes in multi-tenant environments where a low-privileged guest user escalating locally can undermine tenant isolation. Net: high-value for internal/host-hardening and vGPU operators, low urgency for perimeter defenders.

A low-privileged local user (or a guest-VM user in a vGPU deployment) issues crafted requests to the NVIDIA kernel-mode driver interface, exploiting the missing authorization check to alter privileged driver configuration. Because complexity is low and no user interaction is required, the attacker escalates to code execution or privileged control of the GPU subsystem, potentially tampering with data or disrupting service. No public exploit code was identified at time of analysis.