Description
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Published: 2026-09-30
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a double‑free condition in the kernel‑mode component of NVIDIA’s Linux GPU Display Driver. An unprivileged user can trigger a double free of imported memory state, which may lead to arbitrary code execution, privilege escalation, denial of service, information disclosure or data tampering. This flaw represents a classic CWE‑415 issue.

Affected Systems

Affected are NVIDIA GPU drivers for the GeForce, RTX, Quadro, NVS, Tesla families and the Guest driver on Linux platforms. All current driver releases that include the vulnerable kernel‑mode code are impacted; specific version ranges are not detailed by the CNA.

Risk and Exploitability

The CVSS score of 7.8 indicates a high impact risk. Although EPSS data is unavailable, the condition can be triggered by any local user, presenting a local privilege escalation vector that could be leveraged for remote code execution once local access is achieved. The vulnerability is not yet listed in CISA’s KEV catalog, suggesting no confirmed exploits yet, but the potential for exploitation remains significant.

Generated by OpenCVE AI on October 1, 2026 at 03:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade NVIDIA GPU drivers to the latest release that includes the kernel‑mode memory handling fix.
  • Apply any relevant operating‑system kernel patches that address similar memory handling issues.
  • Restrict local user privileges and monitor kernel logs for abnormal memory deallocation events.

Generated by OpenCVE AI on October 1, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Double-Free in NVIDIA Linux GPU Kernel Mode Driver nvidia-driver: nvidia-driver: Privilege escalation via double-free of imported memory state
Weaknesses CWE-1341
Metrics threat_severity

None

 threat_severity

Important

Wed, 30 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia geforce
Nvidia guest Driver
Nvidia nvs
Nvidia quadro
Nvidia rtx
Nvidia tesla
Vendors & Products Nvidia
Nvidia geforce
Nvidia guest Driver
Nvidia nvs
Nvidia quadro
Nvidia rtx
Nvidia tesla

Wed, 30 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Title Double-Free in NVIDIA Linux GPU Kernel Mode Driver

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Weaknesses CWE-415
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Nvidia Geforce Guest Driver Nvs Quadro Rtx Tesla
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-10-01T03:56:39.196Z

Reserved: 2026-05-19T19:55:45.574Z

Link: CVE-2026-47558

cve-icon Vulnrichment

Updated: 2026-09-30T17:57:18.494Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T16:17:24.227

Modified: 2026-10-01T04:18:15.973

Link: CVE-2026-47558

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-30T15:50:24Z

Links: CVE-2026-47558 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T03:45:17Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free