CVE-2026-47598
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged local user could cause a use-after-free through a race between asynchronous event delivery and file close. A successful exploit might lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering.
Risk Assessment
The risk includes the possibility of an unprivileged user gaining control over the system, potentially leading to breaches of data confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately apply the NVIDIA GPU driver update provided by the vendor and restrict local access to systems using this driver.
Other vulnerabilities in NVIDIA GPU Display Driver
See all- CVE-2017-6272High
The NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array. This may lead to denial of service or possible escalation of privileges.
- CVE-2017-6257High
The NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.
- CVE-2017-0352High
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware that may allow incorrect access to sensitive GPU control registers by the CPU, leading to an escalation of privileges.
- CVE-2017-0351High
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
- CVE-2017-0350High
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated. This may lead to denial of service or potential escalation of privileges.
- CVE-2017-0321High
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.
- CVE-2017-0309High
All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges.
- CVE-2016-7389High
The NVIDIA GPU Display Driver on Linux in versions R304 before 304.132, R340 before 340.98, R367 before 367.55, R361_93 before 361.93.03, and R370 before 370.28 contains a vulnerability in the kernel mode layer (nvidia.ko) handler for mmap(). Improper input validation may allow users to gain access to arbitrary physical memory, leading to an escalation of privileges.
- CVE-2026-47604Medium
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure.
- CVE-2026-47603Medium
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure.
Original NVD description (English source)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged local user could cause a use-after-free through a race between asynchronous event delivery and file close. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS