NVIDIA GPU Driver EUVD-2026-90168

Requires local access with a low-privileged account on a system running the affected NVIDIA GPU Display Driver (GeForce, RTX/Quadro/NVS, or Tesla) on Windows or Linux, or the affected Guest Driver/Virtual GPU Manager in a vGPU deployment; the attacker invokes the kernel-mode driver interface directly. Exploitation is LIMITED by the need for pre-existing local authenticated access (PR:L, AV:L - not remotely reachable) and by driver version: only versions prior to the fixed releases (e.g., GeForce < 580.178.04/616.56, RTX/Quadro/NVS < 610.88/615.71.09, vGPU <= 20.1) are affected, and for one GeForce branch only Maxwell, Volta, and Pascal architectures. Impact is capped at denial of service - no code execution, privilege escalation, or data disclosure is possible.

This is a genuinely low-to-moderate priority issue despite the 5.5 (Medium) CVSS. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent with the description: an already-authenticated local low-privileged user triggers a kernel-mode improper access control flaw (CWE-862) whose only impact is denial of service (A:H, with C:N and I:N confirming no data exposure or integrity loss). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active exploitation or automated weaponization. The realistic worst case is a local user crashing/hanging the GPU driver or host - a stability/availability nuisance rather than a privilege-escalation or RCE threat. No signals conflict here: the CVSS local vector matches the 'kernel mode layer' local-trigger description and the DoS-only impact. The one caveat worth verifying with the vendor is the 'Authentication Bypass' tag, which overstates the outcome - CWE-862 is a missing-authorization (authz) weakness and the confirmed impact is DoS, not an authentication bypass.

A local user with an unprivileged account on a Windows or Linux workstation or vGPU-backed VM issues a crafted request to the NVIDIA kernel-mode driver that the driver fails to properly authorize, causing the driver or host to crash or hang. No public proof-of-concept exists; exploitation yields only denial of service, not code execution or data access.