The flaw is in the kernel mode driver of NVIDIA GPU Display Driver for Windows and Linux. A missing authorization check allows a local user to read the channel state of another process, which could reveal sensitive GPU memory contents or process state. The impact is thus a moderate level of information disclosure.

The affected products belong to NVIDIA’s GeForce, RTX, Quadro, and NVS lines, including the Guest driver, Virtual GPU Manager, and Tesla GPUs. No specific version numbers are listed in the update, so any installed NVIDIA drivers that incorporate the vulnerable kernel module are at risk unless they have received a patch.

The CVSS score 5.5 indicates moderate severity, and the EPSS metric is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Attack would require local system access; the missing authorization allows the local user to read another process’s GPU channel data. No public exploit is noted, but the exploitation pathway is straightforward for an authenticated local user with sufficient privileges.