NVIDIA GPU Driver EUVD-2026-90184

Requires local access to a Linux host running the NVIDIA GPU Display Driver, plus the ability to invoke the kernel-mode layer interface that accepts a version string (PR:L - an authenticated low-privilege local account is sufficient, no separate admin rights and no user interaction needed). Exploitation is limited by the local-only attack vector (AV:L) - there is no remote or network path - and the impact is confined to integrity and availability of the kernel log (I:L/A:L), with no confidentiality exposure. It affects Linux GPU driver deployments specifically (GeForce, RTX/Quadro/NVS, Tesla, Guest Driver, and Virtual GPU Manager variants).

All exploitation signals point to a low-priority, low-impact issue despite the product's wide deployment. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L = 4.4 MEDIUM) describes a purely local attack requiring an already-authenticated low-privilege user, with only Low integrity and Low availability impact and zero confidentiality impact - consistent with a kernel-log injection (CWE-116) rather than memory corruption or privilege escalation. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no evidence of active or automatable exploitation. The realistic worst case is log forgery/tampering and possibly log-driven DoS (e.g., flooding or corrupting the kernel ring buffer), not code execution or data theft. This is a genuine 'low real-risk' item: the only thing elevating attention is that NVIDIA display drivers are broadly deployed, but the attack surface is local and the technical impact is minor. No conflicting signals were detected - CVSS, CWE, and description all agree this is a local, low-impact tampering/DoS flaw.

A local low-privilege user on a Linux host with the NVIDIA GPU driver installed invokes the kernel-mode interface with a maliciously crafted version string containing unsanitized control/formatting characters, which is written verbatim into the kernel log. This lets the attacker forge or corrupt log entries (masking other activity or misleading administrators) and potentially degrade the logging subsystem, causing denial of service. No public exploit code is identified at time of analysis, and the local-only, authenticated nature (AV:L/PR:L) limits it to users who already have shell access.