NVIDIA GPU Driver EUVD-2026-90158

Requires local access to a Linux system running an affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla branches below the fixed versions such as 580.178.04, 596.86, 610.57.04/610.88/616.92, or 615.71.09 depending on branch; older GeForce Maxwell/Volta/Pascal GPUs affected below 582.78). Per CVSS PR:H, the attacker must already hold high/administrative privileges before interacting with the kernel-mode driver interface; no user interaction is needed (UI:N). Limiting factors: local-only attack surface (no remote/network path), high privilege prerequisite, Linux-only (Windows drivers not in scope here), and only affected driver versions/GPU architectures. These sharply narrow realistic exploitation to post-compromise privilege/kernel escalation.

Real-world risk is MODERATE-LOW despite the memory-corruption impact. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 6.7) is internally consistent with the Linux-only, kernel-mode description and I concur with it. The decisive limiter is PR:H: exploitation requires the attacker to already hold high/administrative privilege on the host, so this is a privilege-boundary/defense-in-depth issue rather than an initial-access vector. AV:L means there is no network-facing exposure - the 'RCE' tag overstates reach since code execution here is strictly local. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of exploitation pressure. Signals are consistent (no conflicts): local vector, high-priv precondition, and absence of exploitation telemetry all point the same direction. This is a high-fidelity-but-modest-priority patch item, not an emergency. Note: the description explicitly scopes this to the Linux kernel-mode layer, and the Linux tag and CPE set corroborate that.

A local attacker who already possesses elevated privileges on a Linux host with a vulnerable NVIDIA driver issues crafted ioctl/command input to the kernel-mode driver layer, triggering an out-of-bounds write. By shaping adjacent kernel memory, the attacker can corrupt kernel state to escalate to full kernel code execution or crash the system. No public exploit code is identified at time of analysis.