NVIDIA GPU Driver EUVD-2026-90117

Requires local access as an authenticated low-privileged user (PR:L, AV:L, UI:N) on a Linux system running the affected NVIDIA GPU Display Driver, with the ability to invoke the kernel-mode driver layer (e.g., via device ioctls). The 'Guest Driver' and 'Virtual GPU Manager' tags indicate the vGPU path is in scope, so a guest VM in a virtualized/vGPU deployment is a valid attack position. Limiting factors: no remote vector (not network-exploitable), the attacker must already have a local foothold or guest session, and the reliably achievable outcome is a driver/kernel crash (DoS) - higher impacts such as code execution are not confirmed and would be more complex to achieve.

This is an NVIDIA-reported vulnerability (bulletin 5861) with no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, so the risk is theoretical rather than demonstrated. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) correctly reflects a local, low-privilege attack surface - the attacker must already be an authenticated local user able to issue calls to the kernel-mode GPU driver - which meaningfully caps real-world risk versus a network-facing flaw. The root cause is a NULL pointer dereference (CWE-476), whose most reliable and natural outcome is denial of service (kernel crash/host hang); the vendor's boilerplate 'might lead to code execution, escalation of privileges, information disclosure, and data tampering' with a full C:H/I:H/A:H rating is optimistic for a NULL-deref class bug - I DISAGREE that confidentiality/integrity impact is realistically High, as promoting a NULL deref to code execution is typically high-complexity and not guaranteed. The 'Guest Driver' / 'Virtual GPU Manager' tags indicate a vGPU/virtualization path, which raises stakes in multi-tenant VDI and cloud-GPU environments where a guest crash could affect the host. Net: a genuine but medium-priority local issue for shared/virtualized GPU deployments; low priority for single-user workstations. No conflicting signals in the vector itself, but verify the true achievable impact (DoS-only vs. full RCE) against NVIDIA's advisory.

A low-privileged local user (or a guest VM in a vGPU deployment) on a Linux host with the NVIDIA GPU driver issues a crafted ioctl or API call to the kernel-mode layer that triggers a NULL pointer dereference. This crashes the driver/kernel, causing denial of service to the host or other tenants; the vendor states it might be leveraged further toward privilege escalation or code execution. No public exploit code has been identified.