The NVIDIA GPU Display Driver for Linux includes an out‑of‑bounds write flaw (CWE‑787) in the Virtual GPU Manager (vGPU plugin). A guest VM can send a specially‑crafted RPC message containing an invalid performance‑state list size, which can overwrite memory beyond the intended buffer. This flaw potentially allows the attacker to execute arbitrary code, elevate privileges to the host, tamper with data, disrupt service, or reveal sensitive information.

The issue affects NVIDIA’s Virtual GPU Manager component used in Linux GPU‑accelerated virtual machines. It is present in all builds that include the vGPU plugin; specific version numbers are not disclosed, so any host running the vGPU manager is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity exposed from the guest to the host. The EPSS score is not available, so the current likelihood of exploitation is uncertain, but the flaw is not listed in the CISA KEV catalog. The most likely attack path involves a malicious guest VM transmitting the malformed RPC request; no special privileges are required within the VM. If exploited, the attacker could gain code execution on the host, enabling further attacks or data theft.