NVIDIA Display Driver EUVD-2026-90176

Requires local access to a Linux host running the affected NVIDIA GPU Display Driver, plus the ability to invoke the kernel-mode DRM/GPU interface as an authenticated low-privileged user (PR:L) - no user interaction and no admin rights are needed. Exploitation is LIMITED to Linux (Windows drivers are not in scope here), requires an existing local foothold (no remote/network vector), and yields only denial of service - it cannot be leveraged for code execution, privilege escalation, or data disclosure. Practical impact is highest on shared or multi-tenant GPU systems (VDI, cloud GPU, Tesla/vGPU compute) where one user's exhaustion of the DRM VMA offset space degrades service for others.

All signals converge on this being a genuine but low-severity, low-priority issue rather than a high-impact threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 MEDIUM) is internally consistent with the description: local access, low attacker complexity, and low existing privileges are required, and the ONLY impact is availability (A:H) - there is no confidentiality or integrity impact (C:N/I:N), which matches a CWE-400 uncontrolled-resource-consumption denial of service. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization. The local attack vector plus the DoS-only impact sharply caps real-world risk: an attacker who can already run code on the host can at most crash or hang the GPU/graphics subsystem, not escalate privileges or steal data. This is a real priority only for multi-tenant or availability-sensitive Linux GPU deployments (VDI, cloud GPU, shared compute); for typical single-user systems it is a low-priority hardening fix. No key signals are conflicting - the vector and description agree that this is local and DoS-only.

A local, low-privileged user on a Linux host with the NVIDIA GPU driver repeatedly issues driver/DRM operations that allocate VMA offset mappings until the DRM VMA offset address space is exhausted, causing the kernel-mode driver to fail further allocations and denying GPU/display service to the system and other users. No user interaction or elevated privileges are needed, but the attacker must already have local shell access. No public exploit code was identified at time of analysis.