An out-of-bounds write is possible within the kernel-mode layer of NVIDIA’s GPU display driver for Linux when the ioctl input buffer size is not validated. The flaw permits an unprivileged user to corrupt kernel memory, with the documented potential for code execution, denial of service, privilege escalation, information disclosure, and data tampering. The weakness is classified as CWE‑787.

The vulnerability affects NVIDIA drivers that include GeForce, RTX, Quadro, NVS, Tesla, Guest Driver, and the Virtual GPU Manager on Linux platforms. All listed NVIDIA GPU families are impacted, as referenced by the CNA vendors and products list.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, so the exact probability of exploitation cannot be quantified. The flaw is not yet listed in the CISA KEV catalog. The likely attack vector is local; an unprivileged user running a crafted command can trigger the ioctl and exploit the memory corruption. Because the handler runs with kernel privileges, the exploitation path can elevate privileges or execute arbitrary code.