NVIDIA Display Driver EUVD-2026-90147

Requires an already-present unprivileged local user or code-execution foothold on a Linux system running the affected NVIDIA GPU Display Driver kernel-mode module (GeForce, RTX/Quadro/NVS, or Tesla, including Guest Driver/vGPU deployments). Exploitation is limited by high attack complexity (AC:H) - the attacker must drive a specific driver operation sequence to hit the code path where read-only memory permissions are not preserved - and no remote or unauthenticated path exists. The vendor-supplied AV:P would additionally imply physical access, but this conflicts with the 'unprivileged user' software description and should be confirmed against NVIDIA bulletin 5861.

This is a local/physical privilege-escalation flaw in the NVIDIA GPU Display Driver for Linux kernel-mode layer, not a remote-network issue despite the 'RCE' tag. The vendor CVSS3.1 vector (AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 7.0) contains a likely error: it specifies AV:P (Physical), yet the description states an unprivileged software user writes to read-only memory - that behavior is exploitable by a local process and should be AV:L (Local), not Physical. Verify attack vector with NVIDIA bulletin 5861. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent widespread exploitation. The high 7.0/scope-changed (S:C) rating derives from full kernel compromise (C:H/I:H/A:H) rather than ease of attack - AC:H and PR:L both raise the exploitation bar. Net: a genuinely impactful local privesc primitive on a very widely deployed driver, but current real-world risk is moderate absent exploitation evidence and given the required local foothold and high attack complexity. It is a patch-in-normal-cycle item, not an emergency.

An attacker who already has an unprivileged local account or a code-execution foothold on a Linux host with an NVIDIA GPU driver issues a crafted sequence of driver operations that causes kernel-mode code to write to memory whose read-only permissions were not preserved, corrupting kernel state. By steering that write, the attacker escalates to kernel-level privileges and executes code in the kernel context. No public exploit code was identified at time of analysis, and the vendor's AC:H rating implies non-trivial timing or state control is required.