Description
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Published: 2026-09-30
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privileged code execution leading to privilege escalation
Action: Assess impact
AI Analysis

Impact

NVIDIA GPU Display Driver for Linux contains a memory permission flaw that allows an unprivileged user to change read‑only memory into writable memory. This loss of protection permits kernel‑level code execution, potentially giving the attacker full control over the host. The vulnerability is classified as CWE‑281, representing an improper restriction of a resource in a privileged context.

Affected Systems

All NVIDIA GPU drivers for Linux, including GeForce, RTX, Quadro, NVS, Tesla, and related guest drivers. Version information is not publicly disclosed.

Risk and Exploitability

The CVSS base score is 7, indicating a medium‑to‑high severity. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack might be local and would require the driver to be loaded. Consequently, the risk is significant for systems with untrusted users who have access to the GPU drivers.

Generated by OpenCVE AI on September 30, 2026 at 18:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check NVIDIA's product‑security page for a driver update that addresses the memory permission issue and apply the latest patch.
  • If no patch is available, prevent unprivileged users from loading kernel modules that use the GPU driver by enforcing module‑load restrictions or removing the driver from the unprivileged user’s path.
  • Enable kernel logging and audit for suspicious memory writes or unauthorized module activity to detect attempts to exploit the flaw.

Generated by OpenCVE AI on September 30, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title GPU Display Driver for Linux Memory Permission Violation Enables Privilege Escalation nvidia-driver: nvidia-driver: Privilege escalation via unpreserved memory permissions
Metrics threat_severity

None

 threat_severity

Important

Thu, 01 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia geforce
Nvidia guest Driver
Nvidia nvs
Nvidia quadro
Nvidia rtx
Nvidia tesla
Vendors & Products Nvidia
Nvidia geforce
Nvidia guest Driver
Nvidia nvs
Nvidia quadro
Nvidia rtx
Nvidia tesla

Wed, 30 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Title GPU Display Driver for Linux Memory Permission Violation Enables Privilege Escalation

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Weaknesses CWE-281
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Nvidia Geforce Guest Driver Nvs Quadro Rtx Tesla
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-09-30T17:29:29.990Z

Reserved: 2026-05-19T19:55:49.283Z

Link: CVE-2026-47596

cve-icon Vulnrichment

Updated: 2026-09-30T17:25:08.931Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T16:17:29.827

Modified: 2026-09-30T18:18:35.687

Link: CVE-2026-47596

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-30T15:52:21Z

Links: CVE-2026-47596 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T23:45:09Z

Weaknesses
  • CWE-281

    Improper Preservation of Permissions