NVIDIA Display Driver EUVD-2026-90170

Requires local access to a Linux host running an affected NVIDIA GPU Display Driver (GeForce/RTX/Quadro/NVS/Tesla, Guest Driver, or Virtual GPU Manager) with the ability to open the GPU device node and issue ioctls - i.e., a logged-in local user or a low-privileged process/container granted GPU device access (PR:L). No user interaction, no authentication beyond local low privilege, and no special non-default configuration are needed; standard GPU compute/graphics access is sufficient. Limiting factors: the attack vector is strictly local (not remotely reachable over the network), and impact is confined to denial of service - no privilege escalation, code execution, or data exposure is achievable through this flaw. Affected versions include lines prior to 595.91.07, 610.57.04, 615.71.09, 580.178.04, and the corresponding vGPU 19.5/20.1 guest and manager builds.

This is a genuinely low-to-moderate priority issue whose CVSS 5.5 (Medium) accurately reflects a bounded, availability-only impact. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H requires local access with low privileges and yields only availability loss (C:N/I:N/A:H) - a NULL pointer dereference in the kernel-mode driver that crashes the driver/host, not code execution or data disclosure. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is no public exploit identified at time of analysis. There are no conflicting signals: the description ('local user', 'null pointer dereference', 'denial of service') is fully consistent with the vector. The main risk driver is that ioctl-triggerable NULL derefs are typically easy to reproduce once found (AC:L), but the local-only vector and DoS-only ceiling keep real-world risk modest - this is a reliability/robustness bug, not a breach vector. It belongs in routine driver patch cycles rather than emergency remediation.

A local user with an active login (or a low-privileged process/container with GPU device access) on a Linux host running an affected NVIDIA driver opens the GPU device node and issues a crafted ioctl with malformed parameters. The kernel-mode driver dereferences a NULL pointer while processing the request, crashing the driver and typically the host or GPU workload. No public exploit code is known, but AV:L/AC:L means a reliable crash PoC would be straightforward for someone with device access.