An unprivileged user can trigger a use‑after‑free in the NVIDIA GPU Display Driver for Linux. The vulnerability allows arbitrary code execution in the kernel context, raising the privileges of the attacker, and can also lead to denial of service, information disclosure, and data tampering. The flaw stems from a classic use‑after‑free violation (CWE‑416) and improper resource handling (CWE‑825).

The flaw affects all NVIDIA GPU devices that rely on the Linux display driver, including GeForce, RTX, Quadro, NVS, and Tesla product lines. Any system running the affected driver on a Linux kernel can be impacted. Specific driver versions are not listed in the advisory, so all current releases should be considered vulnerable until a patch is applied.

The CVSS score of 7.8 indicates a high severity vulnerability. EPSS data is not available, but the lack of a KEV listing does not diminish the risk, as the flaw can be exploited locally by an unprivileged user. A successful local exploit would require the attacker to have ordinary user privileges on the affected machine, after which they can gain full kernel execution. The attack vector is therefore local, leveraging normal user space access to the GPU driver kernel module.