NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open‑source kernel module DMA‑BUF import path that allows an unprivileged local user to import a read‑only buffer from another device’s DMA‑BUF exporter. The flaw leads to improper preservation of memory access permissions, giving the user the ability to execute code, gain higher privileges, or cause denial of service and potential information disclosure. The weakness is a classic out‑of‑bounds write reflected in CWE-787, and also involves improper permission handling identified as CWE-281.

The affected products are NVIDIA GPUs, including GeForce, RTX, Quadro, NVS, and Tesla lines. Specific driver or kernel module revisions are not listed, so any installation of the NVIDIA GPU Display Driver on Windows or Linux that includes the exposed DMA‑BUF import path is vulnerable.

The CVSS score of 7.8 indicates a high severity, and although the EPSS score is not available, the lack of KEV listing suggests it has not yet been widely exploited in the wild. The attack requires local access and no special privileges, so any user on the system can trigger the flaw. If successfully exploited, the attacker could obtain root privileges, crash the driver, or exfiltrate data from protected memory.