NVIDIA Display Driver EUVD-2026-90121

Requires local access: the attacker must already be able to run code as a low-privileged user (PR:L) on a Linux host running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) and be able to interact with the kernel-mode driver interface (device node/ioctl path). No user interaction is needed (UI:N). Limiting factors: exploitation is not remote (AV:L) despite the 'RCE' tag, is confined to systems with the NVIDIA proprietary driver installed and a GPU present, and affects only the Linux driver - Windows is not listed. Highest practical relevance is multi-user Linux hosts, GPU compute nodes, and cloud/VDI GPU instances where untrusted users share a machine.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is driven by the local attack vector combined with high impact across confidentiality, integrity, and availability - a classic kernel-mode local privilege-escalation profile. The vulnerability is CWE-843 (type confusion) in the NVIDIA Linux kernel-mode driver, so the attacker must already have local low-privilege code execution (PR:L) on the host; there is no network reach despite the 'RCE' tag, which is misleading given AV:L. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active or automated exploitation. Realistically this is a meaningful-but-not-emergency issue: high technical impact and low attack complexity make it a strong candidate for the local escalation stage of a broader intrusion, but the lack of remote reach and absence of any exploitation signal keep it below the tier of internet-facing critical bugs. The 'code execution' language in the description refers to kernel/privileged code execution reached from local access, not unauthenticated remote code execution - do not treat the 'RCE' tag as network exploitability.

An attacker who already has an unprivileged local account or code execution on a Linux system with the affected NVIDIA driver (e.g., a shared multi-user workstation, CI runner, or a GPU cloud/VDI instance) issues crafted ioctl calls to the kernel-mode driver to trigger a type confusion. Successful exploitation corrupts kernel memory, allowing escalation to root, denial of service, or disclosure/tampering of kernel data. No public exploit code was identified at time of analysis, and exploitation requires prior local access.