The vulnerability resides in NVIDIA’s kernel driver for Windows and Linux and allows a local user to assign incorrect permissions to a critical resource. This misassignment can lead to unauthorized modification of data and can cause the affected device or service to become unusable. The weakness is identified as a classic input validation error where the driver fails to enforce proper access control.

NVIDIA products such as GeForce, RTX, Quadro, NVS, Tesla and the Guest driver are affected. The issue exists on both Windows and Linux operating systems. No specific firmware, driver, or device version information is provided in the report, so all current releases of these products should be checked for the update.

The CVSS score of 4.4 classifies the impact as low severity, and no EPSS score is listed, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the error stems from a local permission assignment flaw, exploitation requires local user access or the ability to load or modify kernel drivers. As such, the risk is limited to environments where privileged users or compromised accounts can interact directly with the NVIDIA kernel driver.