The vulnerability resides in the kernel mode layer of NVIDIA’s GPU Display Driver for Linux, where the driver fails to preserve memory permissions during certain operations. An unprivileged local user can formulate an input that writes to memory marked read‑only, allowing the attacker to manipulate driver state. An attacker can then trigger the modified state to execute arbitrary code, raise privileges to kernel or root level, or cause denial of service, data tampering, and information disclosure. The weakness is categorized as CWE‑281, improper authorization, reflecting the failure to enforce correct access control on privileged resources.

This issue affects NVIDIA GPU Display Driver for Linux across several product lines, including GeForce, RTX, Quadro, NVS, Tesla, and the Guest driver. No specific version range is supplied, so any installation of the driver before the vendor’s patch is potentially vulnerable.

With a CVSS score of 7.8 the vulnerability is considered high severity. EPSS data is not available and KEV does not list this vulnerability, so the exploitation probability is uncertain, but the local, unprivileged attacker nature combined with the potential for kernel‑level compromise suggests a serious risk. The attack vector is inferred to be local; an attacker needs access to the target machine but not elevated privileges. The impact could translate into full system compromise or denial of critical services.