NVIDIA vGPU Virtual GPU Manager for Linux includes a kernel mode layer flaw that can trigger an out-of-bounds read. When successfully leveraged, the vulnerability may allow an attacker to execute arbitrary code, crash the system, elevate privileges to root, expose sensitive data, or tamper with data integrity. The weakness is identified as CWE‑125 – Out‑of‑Bounds Read.

All Linux installations of NVIDIA Virtual GPU Manager are impacted. No specific version constraints are listed, so any deployment of the product on Linux should be considered vulnerable until a patch is made available by NVIDIA.

The CVSS score is 7.8, indicating a high severity risk. EPSS information is not available, making the current exploitation probability unclear, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploitation yet. The likely attack vector is local; an adversary with sufficient access to the system could load malicious code into the kernel module or manipulate the GPU sysctls to trigger the read, leading to privilege escalation or code execution. Until vendor remediation is released, the risk remains significant due to the high impact and the potential for sequence exploitation.