An unprivileged local user can exploit a flaw in NVIDIA’s open‑source kernel module for the Linux GPU display driver, where memory‑access permissions are not properly preserved during DMA mapping. This weakness allows an attacker to execute arbitrary code, increase privileges, disrupt service, expose confidential information, and tamper with data, and it is classified as CWE‑281.

All NVIDIA driver packages for Linux that provide GPUs – GeForce, RTX, Quadro, NVS and Tesla – are affected. The advisory does not specify driver revisions, so any deployment of the NVIDIA GPU Display Driver on Linux should be considered vulnerable until a vendor update corrects the DMA permission handling.

With a CVSS score of 7.8, the vulnerability poses medium to high risk. The EPSS score is unavailable, but the attack requires local access and can lead to code execution and privilege escalation, making it a serious threat on systems with untrusted users. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation yet, yet the local nature means any authenticated user could abuse it via the kernel module. Prompt review of access controls and application of vendor patches is advisable.