NVIDIA GPU Driver EUVD-2026-90174

Requires local access with an unprivileged account on a Linux host running the NVIDIA GPU Display Driver (kernel-mode layer) for GeForce, RTX/Quadro/NVS, or Tesla hardware; the attacker interacts directly with the driver's kernel interface (no user interaction, no elevated privileges beyond a normal local user). Limiting factors: exploitation is local only (AV:L) - there is no network or remote path - and the impact ceiling is denial of service (A:H, C:N/I:N), so it cannot be used for data theft or privilege escalation. Risk is materially higher only in multi-tenant/shared-GPU deployments (VDI, cloud GPU) where a single low-priv user's crash disrupts other users.

This is a genuine-but-low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H = 5.5, MEDIUM) is internally consistent with the description: a local, low-privileged user triggers a kernel-mode NULL pointer dereference (CWE-476) whose only impact is denial of service (A:H, with C:N/I:N). There is no confidentiality or integrity impact and no code-execution path - this is a crash/hang, not a privilege-escalation or RCE bug, so the 'might lead to denial of service' language matches the vector exactly. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is 'no public exploit identified at time of analysis.' Real-world risk is bounded by the local attack vector (attacker must already have code execution as a local user on the host) and the DoS-only outcome; the practical worst case is a local user crashing/hanging the GPU driver or the machine. No conflicting signals were found - the SSVC posture would be exploitation:none, automatable:no (local), technical impact:partial (availability only). Priority is elevated only in shared multi-user, VDI, or cloud-GPU contexts where one low-priv tenant disrupting the host GPU stack affects others.

A local unprivileged user on a Linux host with an NVIDIA GPU issues a crafted or malformed request to the GPU driver's kernel-mode interface (e.g., an ioctl with a parameter that leads the driver down an unchecked code path), causing the kernel to dereference a NULL pointer. The resulting kernel fault crashes or hangs the driver or system, denying GPU service to all users. No public proof-of-concept was identified, and exploitation yields only denial of service - no data disclosure or code execution.