The NVIDIA Display Driver for Linux contains an out‑of‑bounds read flaw (CWE‑125) that allows a malicious actor to read memory outside the intended bounds of the driver. This flaw can cause a denial of service by crashing the driver and can also leak sensitive memory contents, potentially exposing confidential data. The vulnerability is a direct memory corruption weakness that undermines the stability and confidentiality guarantees of the GPU subsystem.

The flaw affects all NVIDIA GPU driver families for Linux, including GeForce, RTX, Quadro, NVS, Tesla, and the Guest driver. All versions of these drivers running on Linux are potentially impacted, as no specific version exclusions are provided.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. Because the driver operates in kernel space, an attacker with local access can trigger the out‑of‑bounds read by executing code that interacts with the driver, leading to a crash or information disclosure. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, as a local kernel‑level flaw, the risk remains significant for devices where the user can load or interact with the driver.