NVIDIA Display Driver EUVD-2026-90138

Requires an unprivileged local user account (or existing local code execution) on a host running the affected NVIDIA GPU Display Driver with the OPEN-SOURCE kernel module loaded; the attacker must reach the Resource Server 'map cleanup' code path where a missing self-reference guard allows a use-after-free. No user interaction and no elevated privileges beyond a normal local account are needed (UI:N, PR:L). Limiting factors: exploitation is LOCAL only (no network vector), depends on the open-source kernel module variant of the driver being in use, and delivers highest impact in shared/multi-tenant GPU environments (vGPU, VDI, cloud GPU) rather than single-user desktops.

All signals point to a genuine but locally-scoped privilege-escalation risk rather than a remotely-wormable emergency. The vendor CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, HIGH) confirms LOCAL attack vector, LOW complexity, and already-present low privilege (PR:L) - meaning an attacker must first have authenticated code-execution ability on the host. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization. The 'RCE' tag is misleading given AV:L: this is local code execution/EoP, not network RCE. The CWE-416 use-after-free in the open-source kernel Resource Server is a classic EoP primitive (low-priv local user → kernel-level code execution), which is why C/I/A are all High under scope-unchanged. Real priority is moderate: highest value in multi-tenant/shared-GPU contexts (vGPU, VDI, cloud GPU, shared workstations) where crossing from an unprivileged account to kernel is a meaningful trust-boundary break; on single-user desktops the blast radius is smaller. No data conflicts the vector; the main metadata issue is a spurious 'Microsoft' vendor tag (the product is NVIDIA's driver) and an absent 'windows' platform tag despite the description covering Windows and Linux.

An attacker who already has an unprivileged local account or code-execution foothold on a machine running the affected NVIDIA GPU driver issues crafted ioctl/driver commands that exercise the Resource Server map cleanup path, triggering a use-after-free due to a missing self-reference guard. By grooming kernel memory around the freed object, the attacker escalates from low privilege to kernel-level code execution. No public exploit code was identified at time of analysis, and exploitation requires local access rather than a network request.