Technical impact
The kernel module in NVIDIA GPU Display Driver for Linux contains a NULL pointer dereference flaw that an unprivileged local user can trigger. When triggered, the driver crashes, interrupting graphics operations and potentially destabilizing the system. The primary consequence is a denial of service to the affected user or process that relies on the GPU.
Affected Systems
Affected products include NVIDIA GeForce, NVIDIA RTX, NVIDIA Quadro, NVIDIA NVS, NVIDIA Tesla GPUs, NVIDIA Guest driver, and NVIDIA Virtual GPU Manager on Linux platforms. The CVE does not specify exact driver versions, so any installation of the NVIDIA GPU Display Driver for Linux may be vulnerable unless a patched version is installed.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity. The exploit requires a local, unprivileged user and does not provide escalation of privilege or data exfiltration. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. An attacker would need local access and could trigger the crash by executing code that interacts with the driver, leading to a service interruption but no broader system compromise.
