NVIDIA Display Driver EUVD-2026-90118

Requires local low-privileged access to a system running the affected NVIDIA GPU Display Driver for Linux (GeForce, RTX/Quadro/NVS, Tesla, or vGPU guest driver / Virtual GPU Manager); the attacker must be able to open and issue ioctls to the NVIDIA kernel-mode device. Exploitation further depends on winning a handle recycle race to induce the type confusion, so success is timing-sensitive and may not be deterministic. No network access and no user interaction are needed, but no remote vector exists. Most relevant on multi-user, VDI, or cloud/virtualized GPU hosts where untrusted users share a driver instance.

This is a local privilege-escalation-class kernel vulnerability, not a remotely exploitable one: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) requires an attacker to already have local, low-privileged access to the host, after which a type confusion in the NVIDIA kernel-mode driver yields full C/I/A impact (kernel-level code execution and privilege escalation). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization - the risk is elevated but currently theoretical. One signal to scrutinize: the flaw is described as a 'handle recycle race,' a timing-dependent condition that typically maps to AC:H, yet NVIDIA rated it AC:L; if winning the race is non-trivial, real-world exploitability is lower than the 7.8 suggests. The 'RCE' tag overstates reach - with AV:L this is local code execution, not network RCE. Net priority is medium: a high-impact, high-prevalence-driver bug, but gated behind local access and a race window, and not known to be exploited.

A low-privileged local user on a Linux workstation, shared GPU host, or multi-tenant VDI/cloud-GPU node opens the NVIDIA device and rapidly allocates and frees driver handles to trigger the recycle race, causing the kernel to interpret a reused handle as the wrong object type. Winning the race corrupts kernel memory and lets the attacker escalate to root or crash the system. No public exploit code is identified at time of analysis, and success depends on reliably hitting the race window.