NVIDIA vGPU Virtual GPU Manager for Linux contains an out‑of‑bounds read in its kernel mode layer. The flaw is a classic array‑index validation error, identified as CWE‑125, that allows an attacker to read beyond the bounds of a buffer. If successfully exploited, the attacker may trigger code execution, elevate privileges, tamper with data, or crash the system, resulting in denial of service. The impact is serious because the vulnerability resides in kernel space and can affect all processes on the host.

The affected components are NVIDIA Guest driver and NVIDIA Virtual GPU Manager on Linux. All releases of the vGPU Virtual GPU Manager that contain this kernel module are susceptible, as no specific version information is provided. The vulnerability affects any host that runs the vGPU manager and allows interaction with virtual GPUs.

The CVSS score of 7.8 indicates high severity, reflecting the potential for remote code execution. EPSS is not available, so the immediate exploitation probability is unclear, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Based on the description, the likely attack vector is local or privileged access to the kernel module, potentially triggered by a malicious virtual machine or application that interacts with the vGPU manager. Therefore, the risk remains high, especially in environments where untrusted workloads are allowed to use virtual GPUs.