Description
NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service.
Published: 2026-09-30
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an out-of-bounds write in NVIDIA's Virtual GPU Manager triggered by a specially crafted RPC call from a guest virtual machine. Overwriting memory outside the intended bounds can allow the attacker to modify host memory, leading to escalation of privileges, tampering of data, and disruption of service on the host system.

Affected Systems

The affected component is NVIDIA's Virtual GPU Manager, which is part of the NVIDIA GPU Display Driver for Linux. No specific product versions are listed, so any deployment of the vGPU plugin in a Linux environment may be impacted.

Risk and Exploitability

The CVSS score of 7.3 indicates high severity. EPSS data is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a local or privileged guest VM that can send the crafted RPC call to the host, giving an attacker elevated control over host resources.

Generated by OpenCVE AI on September 30, 2026 at 18:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest NVIDIA GPU Display Driver update that contains the fix for the Virtual GPU Manager out-of-bounds write.
  • If a patch has not yet been released, consider disabling or removing the Virtual GPU Manager plugin from hosts that do not require virtual GPU services.
  • Monitor host systems for anomalous RPC traffic from guest VMs and configure alerts to detect attempts to exploit memory corruption patterns.

Generated by OpenCVE AI on September 30, 2026 at 18:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia virtual Gpu Manager
Vendors & Products Nvidia
Nvidia virtual Gpu Manager

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Virtual GPU Manager Out-of-Bounds Write Leading to Privilege Escalation nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Privilege escalation via crafted RPC in Virtual GPU Manager
Metrics threat_severity

None

 threat_severity

Important

Wed, 30 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
Title Virtual GPU Manager Out-of-Bounds Write Leading to Privilege Escalation

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service.
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'}

Subscriptions

Nvidia Virtual Gpu Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-10-01T03:55:47.978Z

Reserved: 2026-05-19T19:55:40.488Z

Link: CVE-2026-47496

cve-icon Vulnrichment

Updated: 2026-09-30T17:24:04.783Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T16:17:14.160

Modified: 2026-10-01T04:18:05.850

Link: CVE-2026-47496

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-30T15:54:58Z

Links: CVE-2026-47496 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T01:45:16Z

Weaknesses